Joining and dimensional annotation in a streaming pipeline

ABSTRACT

Disclosed are embodiments for providing batch performance using a stream processor. In one embodiment, a method is disclosed comprising receiving, at a stream processor, an event, the stream processor including a plurality of processing stages; generating, by the stream processor, an augmented event based on the event, the augmented event including at least one additional field not appearing in the event, the additional field generated by an operation selected from the group consisting of a join or dimensional annotation operation; and emitting, by the stream processor, the augmented event to downstream consumer.

COPYRIGHT NOTICE

This application includes material that may be subject to copyrightprotection. The copyright owner has no objection to the facsimilereproduction by anyone of the patent disclosure, as it appears in thePatent and Trademark Office files or records, but otherwise reserves allcopyright rights whatsoever.

BACKGROUND

In the era of big data processing, data pipelines have become vital toingesting, processing, and outputting large quantities of data at highvelocity and having high variability. In general, a data pipelinecomprises a series of automated processing stages that take raw inputdata and convert the raw input data into a more suitable format forconsumption by downstream computer processing systems.

Various architectures of data pipelines exist, including batch, Lambda,and Kappa architectures. Batch data pipelines process data in “batches”at regular intervals and are suitable for non-critical functionalitywhile providing high reliability of data processing. Batch datapipelines, however, suffer from not being able to process data inreal-time. Thus, a lag behind the ingestion of data and output of usefulinformation or knowledge always exists in a batch data pipeline.

Lambda pipelines utilize a batch processor concurrently with a streamprocessor. In these pipelines, the batch processor processes all datawithin a historical batch while the stream processor “augments” theprocessed batch data with the results of stream processing. Eventually,the batch processor will “re-process” the data processed by the streamprocessor and overwrite the information generated by the streamprocessor. Lambda pipelines are fast, due to the use of streamprocessors; however, they require duplication of processing logic inboth the stream processors and the batch processors. Further, Lambdapipelines use twice the processing hardware due to the use of twoseparate processing paradigms (i.e., stream and batch, which process thedata in the same manner).

Like Lambda pipelines, Kappa pipelines utilize a stream processor.However, Kappa pipelines eschew a batch processor. Kappa pipelinesrequire frequent “re-running” of event streams through the streamprocessor to provide simulated batch performance. Kappa pipelines ensurethat streaming data is processed correctly (e.g., the pipeline does notdrop or duplicate data); however, these pipelines ensure this byre-executing processing and are thus slower than pure streamingpipelines. Further, since Kappa pipelines use stream processingtechniques, there is no method for performing more complex operationssuch as joins or aggregations, since these operations inherently requireaccess to a full (e.g., batch) dataset. That is, stream processorsinherently cannot perform these operations, thus replaying streams doesnot remedy this problem.

BRIEF SUMMARY

This disclosure recognizes a need in the art for a new pipelinearchitecture that provides the advantages of stream processors (e.g.,speed) with the advantages of batch processors (e.g., integrity andcomplex operations). The disclosed embodiments provide these advantagesand solve other problems in existing pipelines.

The disclosed embodiments describe an improved big data processingsystem that uses a stream processing engine with additional hardware andsoftware to harden inaccuracies detected during stream processing.

In one embodiment, a method is disclosed comprising receiving, at astream processor, an event, the stream processor including a pluralityof processing stages; generating, by the stream processor, an augmentedevent based on the event, the augmented event including at least oneadditional field not appearing in the event, the additional fieldgenerated by an operation selected from the group consisting of a joinor dimensional annotation operation; and emitting, by the streamprocessor, the augmented event to downstream consumer.

In another embodiment, a non-transitory computer-readable storage mediumfor tangibly storing computer program instructions capable of beingexecuted by a computer processor is disclosed, the computer programinstructions defining the steps of: receiving, at a stream processor, anevent, the stream processor including a plurality of processing stages;generating, by the stream processor, an augmented event based on theevent, the augmented event including at least one additional field notappearing in the event, the additional field generated by an operationselected from the group consisting of a join or dimensional annotationoperation; and emitting, by the stream processor, the augmented event todownstream consumer.

The illustrated embodiments provide numerous benefits over existingpipelines. The disclosed embodiments reduce data processing andcertification times by certifying events using a stream processor versusa batch processor. Thus, the illustrated embodiments, do not require a“waiting” period prior to certifying results and can certify results inreal-time or near real-time. The disclosed embodiments additionallyutilize a single pipeline and thus do not require the hardwareduplication, software complexity, and human resources required by Lambdapipelines. Relatedly, since application-level code must only be deployedonce, rapid changes in data processing can be implemented withoutrequiring separate development workflows. Additionally, since only onecodebase is used, there is no risk of variations in processing betweenpipelines. Finally, in existing pipelines, sacrifices for speed can leadto a more significant variation between the initially posted resultsfrom the streaming pipeline and the final results from batch processing.As the latency of batch increases relative to streaming, this can leadto a lack of confidence in reporting as the variation becomes morepronounced. The disclosed embodiments alleviate this deficiency.

BRIEF DESCRIPTION OF THE FIGURES

FIG. 1A is a block diagram illustrating a processing system employing aLambda architecture.

FIG. 1B is a block diagram illustrating a processing system employing aKappa architecture.

FIG. 2 is a block diagram illustrating a data processing systemaccording to some embodiments of the disclosure.

FIG. 3 is a block diagram illustrating a pipeline factory according tosome embodiments of the disclosure.

FIG. 4 is a block diagram illustrating a core pipeline according to someembodiments of the disclosure.

FIG. 5A is a block diagram illustrating a streaming pipeline withsupport for join operations according to some embodiments of thedisclosure.

FIGS. 5B and 5C are block diagrams illustrating streaming pipelines withsupport for dimension annotation operations according to someembodiments of the disclosure.

FIG. 6A is a flow diagram illustrating a method for processing joins ina streaming processor according to some embodiments of the disclosure.

FIG. 6B is a flow diagram illustrating the annotation of an event in astream processor according to some embodiments of the disclosure.

FIG. 6C is a flow diagram illustrating a method for processing anaugmented event according to some embodiments of the disclosure.

FIG. 7 is a schematic diagram illustrating a computing device showing anexample embodiment of a client or server device used in the variousembodiments of the disclosure.

DETAILED DESCRIPTION

FIG. 1A is a block diagram illustrating a processing system employing aLambda architecture.

In the illustrated embodiment, events in the system (100 a) originatefrom one or more event emitters (102). As used herein, an event refersto any type of data generated by a computing system. Generally, mostevents include arbitrary data as well as a timestamp indicating when theevent emitter (102) generated the data. Alternatively, or in conjunctionwith the preceding, the system (100 a) adds a timestamp representing thetime the pipelines (106, 108) receive the event. In some embodiments,the timestamp comprises a standard time (e.g., based on a 24-hourclock). In some embodiments, the timestamp comprises a numerical value(e.g., time since UNIX epoch). In other embodiments, the timestamp maycomprise a sequence number or other incrementing (or otherwise changing)value. In some embodiments, events further include nonce values toensure uniqueness.

The event emitters (102) can comprise any computing system capable ofgenerating data. The disclosure places no limitations on the type ofdata or type of systems capable of generating such data. As one example,an event emitter may include a digital analytics system configured totrack and monitor user events on webpages or in mobile apps. A digitalanalytics platform generates many events as users access products. Oneexample is the delivery of advertising creatives. In these scenarios,the analytics platform generates an event indicating that a servertransmitted the creative to the end-user. The analytics platform alsogenerates an event indicating that the end-user device displayed thecreative (i.e., an impression). If the end-user interacts with thecreative, the analytics platform generates a “click” event (which may beany type of interaction including touch events and thus is not limitedto physical mouse clicks). In certain embodiments, the analyticsplatform also generates conversion events that indicate that after animpression, and after a click, the end-user has completed another action(e.g., completes a digital purchase) that is related to the previousevents. In some embodiments, the analytics platform tracks all of theseevents via a client-side identifier stored in, for example, a cookie orother end-user storage mechanism.

In some embodiments, event emitters (102) are part of the system (100a). That is, in some embodiments, the system (100 a) includes and hassome level of control over the event emitters (102). Examples of thistype of arrangement include internal data sources for an organization(e.g., internal analytics tracking). In other embodiments, the eventemitters (102) comprise third-party systems. In some embodiments, thesystem (100 a) receives events from both internal and external eventemitters (102).

In either scenario, event emitters (102) transmit events over atransport layer (104). The transport layer (104) comprises one or morenetwork protocols and one or more physical media used for transportingdata. The disclosure does not unduly limit the structure of thetransport layer. In some embodiments, the system (100 a) uses anInternet protocol suite (e.g., transmission control protocol (TCP) andInternet protocol (IP)) as the transport layer (104). The system (100 a)may use other models such as those adhering to the Open SystemsInterconnection (OSI) model or other types of protocol models. In someembodiments, the transport layer (104) performs other operations on theevents beyond network routing (e.g., TCP/IP). For example, the transportlayer (104) may compress events using, as an example, gzip or othercompression algorithms.

The specific internal workings of the transport layer (104) are notlimiting, and the system (100 a) may ignore various features of thetransport layer (104) that are handled entirely in the transport layer(e.g., congestion control in a TCP layer). However, as discussed in moredetail herein, the transport layer (104) may include inherent datatransfer characteristics that impact the processing of the data bysystems. One example, discussed in more detail in FIG. 2 et seq, is thatsome transport layer (104) designs may unintentionally (or, in somecases, intentionally) duplicate events transmitted over a network. Insuch networks, the event emitters (102) transmit one event, but thepipelines (106, 108) receive two or more events. A more concrete exampleof such a transport layer is a publish-subscribe system such as Apache®Kafka, which can provide “at least once” delivery of events.

As illustrated, the system (100 a) routes events from the transportlayer (104) to both a streaming pipeline (106) and a batch pipeline(108). In the illustrated embodiment, the batch pipeline (108) processesdata in batches. As used herein, a batch refers to a period in which thebatch pipeline (108) analyzes data (e.g., every hour). The disclosuredoes not describe the specific inner workings of the batch pipeline(108) in detail; however, the batch pipeline (108) comprises anyprocessing system that provides accurate processing of data. Examples ofbatch pipelines include Hadoop clusters. The batch pipeline (108)ensures this accuracy by running slowly and at fixed intervals uponreceiving all needed data. Since the batch pipeline (108) requires afixed period of data (e.g., one hour) and a second fixed period toprocess the data (e.g., three hours), the batch pipelines (108) areconsistently “behind” the current time. That is, when the batch pipeline(108) writes data to the data warehouse (110), the data written is“stale” by a fixed amount of time (e.g., four hours in the previousexamples). However, as stated above, consumers of the batch-processeddata can be confident that the data is accurate.

As a brief aside, before Lambda systems, big data systems often onlyincluded a batch pipeline (108) and did not include a streaming pipeline(106). As a result, such systems produced consistently delayed results.To remedy this delay, the system (100 a) includes a streaming pipeline(106). Such a pipeline may comprise one or more stream processors suchas Apache® Storm processors or similar stream processors. In contrast tothe batch pipeline, the streaming pipeline (106) processes data inreal-time or near real-time. Thus, when the streaming pipeline (106)receives an event over the transport layer (104), it immediatelyprocesses or transforms the event and writes the processed event to thedata warehouse (110).

Since the streaming pipeline (106) processes events quickly and inisolation, the streaming pipeline (106) may introduce errors in theprocessed data. For example, the streaming pipeline (106) generally doesnot guard against writing duplicate data if the pipeline (106) receivesduplicate events. Similarly, the streaming pipeline (106) mayinadvertently drop some events. Thus, the streaming pipeline (106) isfast but inaccurate.

In the illustrated embodiment, the data warehouse (110) segments datareceived from the streaming pipeline (106) and the batch pipeline (108)into two separate storage areas. Additionally, as the batch pipeline(108) “catches up” to the data processed by the streaming pipeline(106), the data warehouse (110) overwrites the results of the streamingpipeline (108). Thus, at any given moment, the data warehouse (110)stores accurate, batch-processed data and a smaller, more recent subsetof inaccurate stream-processed data. Absent system failures, the sizesubset of the inaccurate data remains constant while the size of theaccurate data increases over time.

To support the above format of the data warehouse, the system (100 a)must duplicate logic between the streaming pipeline (106) and the batchpipeline (108). Since the streaming results must be “reconciled” withthe results of the batch processing, the streaming pipeline (106) andbatch pipeline (108) must process the events in the same manner. Thisrequirement doubles both the development time and the computingresources needed to support both pipelines (106, 108). Additionally, thesystem (100 a) requires additional software and hardware to enable thedata warehouse (110) to perform the reconciliation process after thecompletion of each batch processing job.

FIG. 1B is a block diagram illustrating a processing system employing aKappa architecture. The illustrated system (100 b) solves some of theproblems of Lambda architectures, as discussed in the preceding figure.However, the system (100 b introduces additional problems and fails toprovide full batch support.

Various elements of the system (100 b) are identical, or nearlyidentical, to those similarly numbered elements of FIG. 1A. The eventemitters (102) and the data transport layer (104) perform the samefunctions as previously described. Also, the streaming pipeline (106)may perform many, if not all, of the same operations of the streamingpipeline (106) discussed in FIG. 1A.

As illustrated, the streaming pipeline (106) receives events generatedby the event emitters (102) over the data transport layer (104). Thestreaming pipeline (106) processes this data and writes the processeddata to the data warehouse (116). In contrast to the data warehouse(110) in FIG. 1A, the data warehouse (116) may only include a singlestorage area for data given the absence of a batch processing layer.

As described in the description of the previous system (100 a),streaming pipelines (106) generally cannot guarantee the accuracy ofdata processing. Some systems (e.g., 100 b) remedy this problem byemploying “micro batching” whereby small batches of stream events areprocessed simultaneously. In general, these batches representmilliseconds of events, thus providing reasonable speed while simulatingsmall batches. Micro-batching, however, fails to provide the level ofaccuracy provided by larger (e.g., one hour) batches. Another techniqueuses recompute logic (114) to re-process streaming events when the logicof the streaming pipeline (106) changes or based on other requirements.In this scenario, the system (100 b) can store raw events in the rawevents storage module (112), the recompute logic (114) retrieves theseevents. The recompute logic (114) then streams the events into thestream pipeline (106) for re-processing. In one scenario, the recomputelogic (114) executes when the system (100 b) changes the processinglogic of the streaming pipeline. Thus, if the system (100 b) modifieshow the streaming pipeline (106) processes events, the recompute logic(114) simulates a historical event stream. In another embodiment, therecompute logic (114) can stream data from the raw events storage module(112) to the streaming pipeline (106) at fixed intervals, thussimulating a batch processing mode. However, there are numerouschallenges to this approach that limit its effectiveness. First, datafrom the raw events storage module (112) must be re-streamed in the sameorder as streamed initially, to ensure the integrity of there-processing. Thus, the recompute logic (114) reproduces inaccuraciesrelating to out-of-order events during the re-streaming. Second, theinfrastructure that supports the streaming pipeline (106) generallycannot handle significant increases in streaming data, thus limiting thetotal amount of re-streamed data the streaming pipeline (106) can handleat any given time. Third, and most importantly, the streaming pipeline(106) cannot inherently perform various operations that a batch pipeline(108) can perform, such as joins or aggregations. Thus, even ifre-streamed, the output of the streaming pipeline (106) always lacksthese advanced operations.

FIG. 2 is a block diagram illustrating a data processing systemaccording to some embodiments of the disclosure.

The illustrated system (200) segments the data processing into multiplelogical layers. In some embodiments, these layers may also comprisephysical layers, with each layer physically connected via a networkinterconnect. The illustrated layers comprise serving (220 a), datatransport (220 b), pipeline factory (220 c), packaging (220 d), andwarehousing (220 e) layers.

The serving layer (220 a) includes one or more event emitters (202). Inthe illustrated embodiment, these event emitters (202) can be similar oridentical to the event emitters (102) discussed previously. As a fewexamples, the event emitters (202) can comprise systems including, butnot limited to, ad servers, web servers, and beacon servers, thatproduce raw traffic events and send the events factory layer (220 c) viathe data transport layer (220 b). In the illustrated embodiment, thedata transport layer (220 b) represents the previously described datatransport (204). In the illustrated embodiment, the data transport layer(220 b) comprises multiple network topologies and protocols that, whencombined, deliver events to the factory layer (220 c).

In the illustrated embodiment, the factory layer (220 c) receives rawevents from the data transport layer (220 b) and processes the eventsvia a core pipeline (210). The description of FIG. 3 provides furtherdetail regarding the factory layer (220 c), and the description of FIG.4 provides further detail regarding the core pipeline (210). Thus, thefollowing description of the factory layer (220 c) only brieflydescribes the layer (220 c) and the core pipeline (210), and FIGS. 3 and4 present further detail.

The factory layer (220 c) is responsible for doing the bulk of theprocessing of event traffic via the core pipeline (210). The followingdescription describes exemplary processing operations performed by thecore pipeline (210). The core pipeline (210) may perform some or all ofthe following operations as well as additional operations.

In one embodiment, in the serving (220 a) and data transport (220 b)layers, devices often compress and bundle data to conserve bandwidth. Asa result, the core pipeline (210) may perform a parsing operation thatunpacks or processes complex data structures (e.g., blobs) so thatdownstream consumer systems can access the data. Thus, as one example,the core pipeline (210) can detect that an incoming event was compressedusing a gzip algorithm and may first unzip the event.

In another embodiment, the core pipeline (210) performs explosionoperations. An explosion operation comprises unpacking composite events.For example, a multi-serve event comprises an event indicating that anend-user device received a set of content to be displayed. Thus, themulti-serve event comprises a data structure describing multiple itemsof content (e.g., advertisements). The core pipeline (210) may transforma single multi-serve event into multiple single-serve events such thateach item of content in the event is associated with an independentevent for later processing.

In another embodiment, the core pipeline (210) performs metadataannotation operations. As illustrated, the core pipeline (210)communicates with a metadata store (208). In one embodiment, themetadata store (208) comprises a data storage device such as a MySQLdatabase or other type of relational database. In other embodiments, themetadata store (208) may comprise other types of data storage devices(e.g., a key-value data store). The core pipeline (210) accesses themetadata store (208) to perform dimensional annotation on incoming eventdata. As used herein, dimensional annotation refers to the augmenting ofdata with additional other data. For example, a content serving eventmay only a line item identifier identifying the served content. The corepipeline (210) may access the metadata store (208) and look up a parentinsertion order, an advertiser identifier, and an organization for thatline item identifier. The core pipeline (210) may then augment the lineitem identifier with this metadata to generate an annotated event. Inthis way, downstream consumer systems can group and aggregate based onthe line item identifier.

In another embodiment, the core pipeline (210) performs trafficannotations. A traffic annotation comprises a complex join of an eventwith a prior event. For example, a click event may need to be joinedwith a first impression event to annotate the click with auctioninformation or targeting information that is only available in the firstimpression.

In another embodiment, the core pipeline (210) performs arbitrarycomputations dictated by business logic. An example of this type ofcomputation is a currency conversion. By doing the operation only oncein the core pipeline (210), the system (200) can ensure consistencyacross all subsequent consumer systems, rather than requiring downstreamconsumer systems to implement the same rules and possibly arrive atdifferent results.

In another embodiment, the core pipeline (210) validates incomingevents. In this embodiment, the core pipeline (210) can filter eventsbased on traffic conditions.

In another embodiment, the core pipeline (210) performs deduplication onincoming events. As discussed previously, the data transport layer (220b) may support “at least once” semantics. Alternatively, or inconjunction with the preceding, event emitters may allow duplicateevents. Regardless of the source of duplication, the core pipeline (210)ensures that all events are processed and stored once and notduplicated. For example, the core pipeline (210) may allow more than oneclick event per impression event during a given period.

In another embodiment, the core pipeline (210) performs normalization onthe received events. During a normalization operation, the core pipeline(210) “fits” an event to a particular schema or layout to facilitatereporting. This schema or layout is typically a standard field alignmentand transformation.

Finally, in some embodiments, the core pipeline (210) performs a fastfeedback operation. In this operation, the core pipeline (210) providesfeeds or streams of data at very low latency to low-latency consumers(206) such as an ad serving budget control system. Typically, mostconsumer systems wait until the core pipeline (210) has completed allprocessing steps; however, some consumer systems are willing tosacrifice quality for timing. These specialty stages can be critical tosome consumer systems.

In general, the core pipeline (210) processes events linearly: thequality of the event data increases as data passes from one processingoperation to the next. Ultimately, after the core pipeline (210) appliesall operations to the event data, the core pipeline (210) writes theprocessed event to one or more fact feeds (212). In the illustratedembodiment, a fact feed (212) comprises a log of every event that wasreceived by the core pipeline (210) and any additional information thatthe core pipeline (210) annotates or computes. The fact feeds (210)become the source of truth for the entire system (200). By having thecore pipeline (210) compute the fact feed (212) used by subsequentconsumers pipelines (214 a, 214 b, 214 n), the overall quality of thesystem (200) is improved.

Since the system uses a centralized fact feed (212), the core pipeline(210) never removes any field from an event. Additionally, the corepipeline (210) does not modify any raw field that it receives from thecore pipeline (210) from the data highway (204). However, as oneexception, the core pipeline (210) may replace null or empty fields witha static or default value, as this may assist downstream consumersystems (214 a, 214 b, 214 n). In most embodiments, the core pipeline(210) does not attempt to “correct” or “fix” invalid values in an event.However, the core pipeline (210) may deviate from this requirement torecover from failed launches or bugs. In some embodiments, if the corepipeline (210) violates this requirement and fixes an invalid value inan event, the core pipeline (210) annotates the record with a flag sothat a downstream consumer system can monitor the rule.

Importantly, the core pipeline (210) also ensures that no event isduplicated in the final fact feed (212). Thus, the core pipeline (210)never intentionally duplicates or allows duplicate events to result fromthe operations.

In the illustrated embodiment, the packaging layer (220 d) comprisesvarious consumer pipelines (214 a, 214 b, . . . 214 n) retrieve orreceive data from the fact feed (212). The packaging layer (220 d)accesses the fact feed (212) and provides the processed events thereinto downstream consumer pipelines (214 a, 214 b, . . . 214 n). Whereasthe factory layer (220 c) is typically a complex, but linear processingstage, the packaging layer (220 d) is typically composed of multipleparallel consumer pipelines (214 a, 214 b, . . . 214 n). Consumerpipelines (214 a, 214 b, . . . 214 n) are typically minimal, possiblysingle-stage pipelines that project and aggregate the events in the factfeed (212) for loading into a warehouse (e.g., 218 a, 218 b, . . . 218n) or similar system. The availability of the fact feed (212) triggersconsumer pipelines (214 a, 214 b, . . . 214 n), and thus the consumerpipelines (214 a, 214 b, . . . 214 n) may run in parallel with oneanother.

In some instances, the consumer pipelines (214 a, 214 b, . . . 214 n)are external to the factory layer (220 c) and warehouse layer (220 e).In other instances, the system (200) includes and controls the consumerpipelines (214 a, 214 b, . . . 214 n). Alternatively, or in conjunctionwith the preceding, the warehousing layer (220 e) may be external to thesystem (200). In various embodiments, the consumer pipelines (214 a, 214b, . . . 214 n) generally perform some or all of the followingoperations (or combinations thereof).

In one embodiment, the consumer pipelines (214 a, 214 b, . . . 214 n)perform mapping and transformation operations. In these operations, theconsumer pipelines (214 a, 214 b, . . . 214 n) may require the data in aformat different than the format of the fact feed (212). For example,the consumer pipelines (214 a, 214 b, . . . 214 n) may map enumeratedvalues (possibly in a lossy fashion) to fit a further downstreamconsumer data model.

In another embodiment, the consumer pipelines (214 a, 214 b, . . . 214n) perform projection operations. In some embodiments, consumerpipelines (214 a, 214 b, . . . 214 n) will typically not require everyfield of the fact feed (212). Thus, the consumer pipelines (214 a, 214b, . . . 214 n) only ingest a small fraction of the available columns.

In another embodiment, the consumer pipelines (214 a, 214 b, . . . 214n) perform aggregation operations. In some embodiments, the consumerpipelines (214 a, 214 b, . . . 214 n) aggregate facts and produce metricfields for efficient loading into a database or similar data store.

In another embodiment, the consumer pipelines (214 a, 214 b, . . . 214n) perform reverse annotation joins (e.g., right outer joins). In someembodiments, the consumer pipelines (214 a, 214 b, . . . 214 n) performjoin operations that cannot be implemented efficiently within the corepipeline (210). For example, a data science consumer pipeline mayrequire a feed containing every impression event joined to any futureclick events recorded in the fact feed (212). Because this type ofpipeline requires data collected over a long period before processingcan begin, it would negatively impact all consumer pipelines (214 a, 214b, . . . 214 n) to wait. Therefore, the pipeline performs these joins inbatch outside of the core pipeline (210).

In another embodiment, the consumer pipelines (214 a, 214 b, . . . 214n) perform rollup operations. In some embodiments, the consumerpipelines (214 a, 214 b, . . . 214 n) may choose to create rollup feedsof the raw facts stored in fact feed (212). For example, the consumerpipelines (214 a, 214 b, . . . 214 n) may create an hourly feed from afive-minute fact feed. The consumer pipelines (214 a, 214 b, . . . 214n) may perform this operation to use fewer filenames in a distributefiled system (e.g., the Hadoop Filesystem, HDFS) since such a filesystem collapses multiple files into larger single files. Further, therollup may typically transform the data into a columnar format likeOptimized Row Columnar (ORC) to promote faster ad hoc projection.

In another embodiment, the consumer pipelines (214 a, 214 b, . . . 214n) perform sketch operations. In some embodiments, as the consumerpipelines (214 a, 214 b, . . . 214 n) generate aggregates, the consumerpipelines (214 a, 214 b, . . . 214 n) may produce aggregate sketchcolumns to capture unique users or similar complex computations. Theconsumer pipelines (214 a, 214 b, 214 n) can perform this expensiveoperation once on behalf of multiple end-users or downstream systems.

In another embodiment, the consumer pipelines (214 a, 214 b, . . . 214n) perform cleansing operations. In some embodiments, the consumerpipelines (214 a, 214 b, . . . 214 n) may cleanse data in the fact feed(212) for a specific purpose. For example, cookies or personallyidentifiable information (PII) might need to be anonymized, or theconsumer pipelines (214 a, 214 b, . . . 214 n) may need to obscure datato enforce data visibility controls.

In some embodiments, the consumer pipelines (214 a, 214 b, . . . 214 n)can be hierarchal. That is, a first consumer pipeline may perform one ormore shared steps, and downstream consumer pipelines use the output ofthe first consumer pipeline as input.

After processing by consumer pipelines (214 a, 214 b, . . . 214 n), eachof the consumer pipelines (214 a, 214 b, . . . 214 n) output furtherprocessed event data to respective data warehouses (218 a, 218 b, . . .218 n) in the warehousing layer (220 e). The warehousing layer (220 e)is generally the final stage of the system (200), where data is loadedinto various systems to facilitate reporting, billing, or analysis. Adata team may be responsible for various aspects of the warehousing, orit may be delegated to a data customer instead. Operations for a datateam include loading, replication, and verification. In loadingoperations, the system (200) may need to load the data into a datawarehouse (e.g., an Oracle or Druid data warehouse) or place the dataonto a shared drop box or similar system. In replication operations, thesystem (200) may need to replicate a data feed to another dataprocessing (e.g., Hadoop) cluster in a different co-location. In averification operation, the system (200) may need to verify that thedata loaded into a warehouse (218 a, 218 b, . . . 218 n) accuratelymatches the original fact feed (210) (i.e. certify there was no dataloss).

As illustrated, in some embodiments, data bypasses the packaging layer(220 d). In these embodiments, the core pipeline (210) streams outputdirectly to a real-time data warehouse (216). In the illustratedembodiment, the real-time data warehouse (216). In the illustratedembodiment, the system (200) may use a real-time data warehouse (216)for reporting or similar functions that do not require high dataaccuracy.

FIG. 3 is a block diagram illustrating a pipeline factory according tosome embodiments of the disclosure.

In the illustrated embodiment, a data highway (204) delivers events fromone or more event emitters (not illustrated) to a factory layer (220 c)and raw event storage (302). The description of FIG. 2 provides furtherdetail regarding the data highway (204) which is not repeated herein.

In the illustrated embodiment, the raw event storage (302) may comprisea distributed file system (e.g., HDFS). In one embodiment, the system(300) writes raw events to the raw event storage (302) as they arereceived. In some embodiments, the system (300) writes the raw events toraw event storage (302) in a batch mode. That is, the system (300)writes a separate file for each batch period (e.g., one hour), the fileincluding all events received during that period. In some embodiments,not illustrated, external consumer systems can access the raw eventstorage (302) to perform batch processing. Thus, in some embodiments,the raw event storage (302) can be used to provide backwardscompatibility with existing batch pipelines.

As illustrated, a stream processor (304) receives events from the datahighway (204). In one embodiment, the stream processor (304) comprises adistributed stream processor. In one embodiment, the stream processor(304) comprises a streaming topology that defines data processing stagesto perform on events.

One example of a stream processor (304) is an Apache® Storm topology.Briefly, a Storm topology is a graph of inputs and processing nodes. Thetopology receives events as input streams. Each event in the inputstream comprises a tuple and the input stream itself is an unboundedseries of such tuples. The topology receives streams from input sources,referred to as “spouts.” The topology performs all processing inindividual processing nodes, referred to as “bolts.” The topologydefines the input to a bolt as either a spout or another bolt. Thus, thetopology defines connects between spouts and bolts. The output of one ormore bolts forms the output of the topology.

In the illustrated embodiment, the stream processor (304) performs anyor all of the processing operations described in the description of corepipeline (210) in FIG. 2 . Details of these operations are not repeatedherein. Importantly, the stream processor (304) ensures that a givenevent received over the data highway (204) is output at most once to thestreaming queue(s) (306). Thus, during processing, the stream processor(304) detects and drops any duplicated events. FIG. 4 provides furtherdetail regarding specific techniques for performing this detection anddropping.

As illustrated, the stream processor (304) outputs the processed andde-duplicated event stream to one or more streaming queues (306). In oneembodiment, the streaming queues (306) comprise one or more Apache®Kafka queues. Since the event stream is processed by the streamprocessor (304), the data stored in the streaming queues (306) can beconsidered as source of truth for downstream consumers. Thus, alow-latency consumer system (206) can directly access the streamingqueues (306). In this manner, the system (300) can simulate a fullystreaming pipeline. As will be discussed, since the stream processor(304) processes the event stream and ensures that no records are droppedor duplicated, the simulated stream in the streaming queues (306) ismore accurate than a raw event stream. Furthermore, as will bediscussed, the output of the stream processor (304) includes the resultsof more complicated or advance operations (e.g., joins or dimensionalannotation) which are not possible using traditional stream processingtechniques.

A spooler (308) and auditor (310) use the output of the stream processor(304) to support advanced operations by the stream processor (304). FIG.4 provides more detail regarding the spooler (308) and reference is madeto that description.

In one embodiment, the spooler (308) comprises a second streamprocessor. The spooler (308) ensures that a one-to-one mapping betweenstreamed data and data written to the fact feed (210) exists. Thespooler (308) also ensures that streaming events retrieved from thequeues (306) appears exactly once in the fact feed (210) (i.e., noevents in the queues, 306, are duplicated). As such, the spooler (308)may comprise a separate stream topology similar to the stream processor(304). In contrast to the stream processor (304), the spooler (308)reads events from the streaming queues (306). Thus, the event stream tothe spooler (308) comprises the processed events. As illustrated, priorto writing to the fact feed (210), the spooler (308) outputs to theauditor (310) via a buffer (312). In one embodiment, the output of thespooler (308) comprises a flat file (e.g., an HDFS file) and the buffer(312) comprises a distributed file system such as HDFS. In oneembodiment, this flat file comprises a set of events occurring in agiven batch period. Thus, the flat file simulates batch processing, butusing the streaming events.

In the illustrated embodiment, an auditor (310) receives the output ofthe spooler (308). As described above, in some embodiments, the outputof the spooler (308) comprises a batch file of events. In theillustrated embodiment, the auditor (310) also accesses raw eventstorage (302). In one embodiment, the format of the raw event storage(302) and the output of the spooler (308) are the same. For example,spooler (308) may write flat files to HDFS buffer (312) and raw eventstorage (302) may comprise raw events stored in the same type of file(e.g., HDFS). In the illustrated embodiment, the auditor (310) retrievesa batch file from buffer (312). In one embodiment, this batch file isassociated with a fixed period. In some embodiments, this fixed periodis represented in the filename or in metadata. Using this fixed period,the auditor (310) then retrieves a set of events from the raw eventstorage (302) matching the fixed period. In one embodiment, the periodsof the buffer (312) and the raw event storage (302) are synchronized. Inthis embodiment, the auditor (310) then retrieves a single file from theraw event storage (302) that matches the period pulled from the buffer(312). In other embodiments, the auditor (310) may execute a MapReducejob to identify events split across multiple files. In this embodiment,the periods represented by files in the raw event storage are notsynchronized with the buffer (312). Thus, the auditor (310) must patchtogether portions of multiple files stored in raw events storage (302)to rebuild a period of raw events matching the period stored in thebuffer (312). In either event, the auditor (310) receives two filescontaining raw events from raw event storage (302) and a set ofprocessed events for the same period stored in buffer (312).

In general, the auditor (310) ensures that each processed event in thebuffer (312) matches a raw event stored in raw event storage (302).Thus, the auditor (310) ensures that no events were dropped duringprocessing by the stream processor (304) and that no events wereduplicated. If the auditor (310) detects that an event exists in the rawevent storage (302) and does not exist in the corresponding buffer (312)output, the auditor (310) sends the missing event back to the streamprocessor (304) for re-processing.

The stream processor (304) reprocesses the events using the sameprocessing logic used to process the event originally. In someembodiments, the stream processor (304) may add a field to thereprocessed event to indicate it was (or will be) reprocessed. In mostembodiments, the stream processor (304) will properly process the eventduring re-processing. However, if the stream processor (304) cannotreprocess the event (as detected by the auditor, 310), the system (300)may gracefully handle the error. In one embodiment, the auditor (310)can itself add a field to the raw event indicating that the raw eventwas not processed and write the event along with the processed events.

After any missing events are re-processed, the auditor (310) writes thefinal output to the fact feed (210). Since spooler (308), buffer (312)and auditor (310) operate on batches of events, the fact feed (210)comprises a simulated batch data store. In some embodiments, the auditor(310) will delay writing to the fact feed (210) until any events arere-processed. In other embodiments, the auditor (310) writes thepartially final output file to the fact feed (210) and updates the fileupon completing the re-processing.

FIG. 4 is a block diagram illustrating a core pipeline according to someembodiments of the disclosure. Various elements of FIG. 4 are describedin the previous figures and those elements are not described againherein.

In the illustrated embodiment, a stream processor (304) receives eventsfrom a data highway (204). In the illustrated embodiment, the streamprocessor (304) receives events from the data highway (204) via aninitial spout (404). The stream processor (304) as illustrated includestwo separate spouts (404, 422). In the illustrated embodiment, thestream processor (304) utilizes two spouts (404, 422) to distinguishbetween event streams (e.g., original versus re-processing). In theillustrated embodiment, the stream processor (304) topology can beconfigured to add additional extract-transform-load (ETL) steps (e.g.,bolts) for the reprocessing spout (422) versus events received via theinitial spout (404).

In the illustrated embodiment, the stream processor (304) processesevents received via spouts (404, 422) via ETL logic (406). As describedpreviously, ETL logic (406) may comprise a series of linear processingstages (e.g., bolts) for each operation performed on events.

In the illustrated embodiment, the ETL logic (406) outputs processedevents to two streaming queues (408 a, 408 b). In one embodiment, thetwo queues (408 a, 408 b) store varying types of event data. Asillustrated, a first queue (408 a) is accessed by a partial streamconsumer system (424). In the illustrated embodiment, the first queue(408 a) may be filled by the ETL logic (406) prior to the execution ofall processing steps. In the illustrated embodiment, the ETL logic (406)may eschew more complicated and time-consuming operations and interruptthe full processing steps to provide low latency operations. In someembodiments, this bypassing includes foregoing joins, trafficprotection, annotation, etc. In the illustrated embodiment, the partialstream consumer system (424) may comprise a fast feedback system such asbudget or pacing systems that are willing to accept a certain level oferror. Thus, the first queue (408 a) provides “best effort” data whereinthe system (400) does not guarantee the accuracy of the data. Inpractice, however, the system (400) will generally process a largeamount of data correctly enough that the best effort data in the firstqueue (408 a) is of value to the partial stream consumer system (424).

In contrast to the first queue (408 a), the stream processor (302) fillsthe second queue (408 b) with the results of the full ETL processing.Thus, the ETL logic (406) fully processes the data in the second queue(408 b), including performing joins, deduplication, annotations, frauddetection, traffic protection, etc. In one embodiment, the completestreaming consumer system (426) access second queue (408 b) can retrievedata that achieves close to exactly once performance (that is, no eventsare dropped or duplicated) since the data was fully processed in the ETLlogic (406). In some embodiments, this performance will meet “exactlyonce” performance. However, in other embodiments, the output of thesecond queue (408 b) is still subject to inaccuracies caused by theunderlying messaging queue. In some embodiments, a near exactly onecompleteness from second queue (408 b) comprises a 99.9% guarantee ofcompleteness. Such a confidence level is often suitable for applicationssuch as real-time reporting.

Finally, as illustrated and discussed above, a final fact feed (210)meets exactly once requirements of all systems and provide batch-likeperformance. That is, data in the fact feed (210) will be fullyde-duplicated and ensure that no events were dropped. As discussed inFIG. 3 , this guarantee is implemented via spooler (308) and auditor(310). Auditor (310) is described more fully in FIG. 3 and those detailsare incorporated herein by reference.

In the illustrated embodiment, the spooler (308) is illustrated asincluding deduplication writer (412), deduplication store (414), and afact feed writer (416).

In the illustrated embodiment, the deduplication writer (412) receivesevents from the second queue (408 b). An event is uniquely identified byan event identifier (event_id). The spooler (308) considers two eventsas duplicates if they have the same event identifier. Events may includeadditional, but standardized, fields such as a type, timestamp, joinstatus, and secondary event identifiers.

The deduplication writer (412) writes each of the events todeduplication store (414). In one embodiment, the store (414) comprisesa database such as HBase or a similar storage device. Upon receiving anevent, the writer (412) analyzes the fields associated with the event.If the event includes one or more secondary event identifiers, thewriter (412) will retrieve all events stored in store (414) matchingthese secondary event identifiers and update the entries to indicatethat a primary event is available (i.e., will be written to the store,414). The writer (412) will then write the received event to the store(414) using the event identifier as a key. In some embodiments, a saltwill be added to the event identifier before using the event identifieras a key. In the illustrated embodiment, the writer (412) will not writethe event if the event has secondary event identifiers and the initialstep of updating the secondary events is not successful. In someembodiments, the writer (412) will serialize the event prior to writingthe event as a value for the event identifier key.

In the illustrated embodiment, the deduplication store (414) storesevents per batch period and per type of event. In some embodiments, thestore (414) creates a new table for each event type and batch periodpair for a fixed period of time (e.g., one week) since the current time.The store (414) additionally includes a pruning process thatperiodically inspects the created tables and removes older tables notoccurring within the current period (e.g., older than one week). In someembodiments, the auditor (310) initiates this pruning process uponconfirming that all data for a given period is certified.

The spooler (308) additionally includes a fact feed writer (416). In theillustrated embodiment, the fact feed writer (416) waits for a signalfrom auditor (310) to trigger a spooling process to write the events inthe store (414) to the fact feed (210) for a particular batch period andevent type. In one embodiment, the fact feed writer (416) includes aninternal web server that comprises a Hypertext Transfer Protocol (HTTP)endpoint that is called by the auditor (310) to initiate the spooling.As described above, once the auditor (310) confirms that the data in thestore (414) is fully processed and certified, the auditor (310) issues acall to the endpoint which causes the writer (416) to start writing tothe fact feed (210). In one embodiment, the writer (416) executes adistributed process routine to per from a full table scan of the store(414) and write the events to the fact feed (210).

For each event in the store (414), the writer (416) will deduplicate theevents prior to writing. In one embodiment, the writer (416) will firstdetermine if an event has one or more secondary identifiers and whetherthat secondary event was successfully joined to the event underinspection. If so, the writer (416) will select the most recentsecondary event and write that joined event to the fact feed (210).Alternatively, if the event under inspection indicates that a primaryevent is available, the writer (416) will skip the event (since a rootevent exists). Finally, if the event does not have secondary identifiersand the primary event flag is not raised, the writer (416) will writeout the event as failed since the secondary event was not properlyjoined.

In some embodiments, low-latency consumers may not want to or be able toconsume a low-latency stream (408 a) directly. For example, the streammight contain personally-identifiable fields that need to be restrictedto specific consumers or the final consumer may need additionalprocessing of events for their use. As another example, the consumer maybe consuming from many sources and is unable to handle different eventschemas of their various inputs. In these scenarios, the system (400)provides derived low-latency streams, or “filters”, that have all of theevents (or at least all of the desired events) as the second queue (408b) stream. Each filter can be associated with a quality of service (QoS)level. In the illustrated embodiment, three QoS levels are provided: “atleast once”, “at most once”, and “at least once with tag.”

A filter having an at least once QoS outputs every event but potentiallyincludes duplicates. In the event of a system (400) failure, the atleast once filter resends previously-sent events. A filter having an atmost once QoS does not include duplicates but potentially drops data.The at most once filter does not reprocess the same event batch morethan once.

Finally, a filter having an at least once with tag QoS generates batchdataset wherein each event in the batch includes tags allowingdownstream consumer systems to detect duplicates. In one embodiment,this filter includes a stream topic, partition, and a “cursor,” that canbe used to detect duplicates. In some embodiments, Kafka offsets and CMSMessage Ids could provide such cursors. The consumer system is thenresponsible for keeping track of the last cursor it processed, anddiscard any subsequent batch with a cursor less than or equal the newbatch. This requires a 1-to-1 correspondence between batches in thepipeline and derived streams.

Each of the above filters may be implemented via a separate streamprocessor (e.g., stream topology). In these embodiments, the filtersutilize an output of the system (400) (e.g., queues 408 a, 408 b) as aninput source (e.g., spout) and output the filtered feed.

For the at least one filter, the filter will always back up in the eventof a failure and resend any events that cannot be confirmed as beingsuccessfully delivered. This filter uses the initial spout (404) andstreaming queue (408 b) as inputs (e.g., filter spouts). In thisembodiment, the consumer is configured to not report its current readoffset. When sending data, the filter spout includes the current eventscursor in a message identifier. The receiver (e.g., sink) would thenacknowledge the received message only after successfully delivering thefiltered output to the derived stream. In some embodiments, the receivercould also use the existing spooler logic to fail a tuple if it can'tdeliver it, and then continue to fail subsequent tuples until itreceives a restarting indication from the spout. Upon receipt of anacknowledgement, the filter spout would commit that cursor back to thesystem (400). On receipt of a fail of a sent event, the filter spoutwould back up the received offset to a cursor at or before the lastacknowledged event and restart sending.

For the at most once filter, the filter spout enables automaticallycommitting offsets in a stream queue. By turning on auto-commitment, thefilter spout only transmits a given event once and does not re-transmitevents causing duplication.

For the at least once with tag filter, the at least one filter mechanismcan be used. However, in this filter, tags will be added prior totransmission to the consumer. These tags include the cursor, asdescribed above, but also a topic and partition if they aren't impliedby the derived stream's partition.

In some embodiments, an exactly once filter may be implemented based onthe at least once with tag filter. In this embodiment, a receiptacknowledgement message can be saved as reliably as the system (400) cansupport. Additionally, the filter, on receipt of the acknowledgement,could update some persistent record of the delivered cursor. However,persisting this data may be computationally expensive and requiresignificant storage. In an alternative embodiment, given the at leastonce with tag filter, the filter, on a start-up or after a failure, canaccess the output stream and read back a plurality of last-sent messagesin the queue. The filter could then determine the tag of the lastmessage written, then discard any replayed events from the spout untilit was caught up, thus ensuring exactly once delivery.

FIG. 6C is a flow diagram illustrating a method for processing anaugmented event according to some embodiments of the disclosure.Numerous details of the method (600 c) are described more fully herein.In brief, the method (600 c) describes receiving an event in step 602 c.In one embodiment, the event is received by a stream processor andcomprises a raw event from a data highway. In step 604 c, the method(600 c) generates an augmented event. In some embodiments, an augmentedevent comprises a joined or dimensionally annotated event generatedusing one or more of a join or dimension annotation operation. Detailsof these operations are provided in FIGS. 6A and 6B, respectively aswell as FIGS. 5A through 5C. In general, the join or dimensionalannotation operation will add one or more fields to an event. In step606 c, the method (600 c) then emits the augmented object to adownstream consumer (e.g., a streaming queue) for further processing bya streaming pipeline, as described above. As described previously,existing stream processors generally cannot perform join or dimensionalannotation operations. The following disclosure describes the technicalsolutions to enable these operations in a purely streaming pipeline.

As described above, a join operation is the combination of two eventsinto a single joined event. A prototypical example of a join operationwould be a Click to Serve Join (or Click to Impression join). In thisexample, a serve represents the event of a digital advertisement beingrequested for display on a web page or mobile application. In this case,the serve event will contain all of the relevant request levelinformation that details why a particular advertisement was chosen.Meanwhile, the click event is relatively thin, containing only a fewinstrumented headers and values, but most importantly, containing a“join key” shared exclusively with the original serve event. The ETLoperation then, is to produce click events that are annotated with allthe juicy details from the corresponding serve.

In batch pipelines, the primary concern is the amount of time lag thatcan occur between the two events, as the batch system must index or readdata over that time period. A streaming system however, must alsoconsider the order in which events occur. This is because a batch systemcan perform the join after a close of books (COB) has been signaled forboth the serve and click event feeds. In contrast, streaming pipelinesdo not have the luxury of waiting. Unless the event emitter (e.g., an adserver) and transport system (e.g., data highway) can guarantee absoluteordering over time, the possibility exists that the click may be queuedinto the pipeline before the serve. For some pipelines, the loss of joinannotation may be acceptable for the low probability out-of-order case.But for large revenue generating systems, the loss of a join annotationcould result in a financial loss, in which case, a streaming pipelinewill need to handle the situation as accurately as possible.

Although the click-serve join is the classic case, another term for thistype of procedure is called sessionization. Sessionization refers to thealignment of one or more secondary events to a given initial event. Inaudience pipelines, this might mean tracking the page navigation fromthe first time a user visits a site. Another example wheresessionization is implemented is video ads. In a video ad use case, thepoint that the ad starts playing may be joined with the point the adreaches the middle, and the point at which the ad completes playing.Generally, and as used herein, the primary event refers the initialevent that declares the join key, and the secondary event is the eventthat needs to be annotated with the primary event that shares the samejoin key.

Whenever a join operation occurs, there is a concept of a join window.Unless a pipeline has infinite memory, it will always beimpossible/impractical to join two events if there is extreme time lagbetween them. For simplicity, the join window is usually measured interm of batch windows, rather than absolute time.

Given the set {P} of all primary events across the join window and theset {S} of secondary events in the same join window, an accuratepipeline should produce the set {S′}={S⁺}∪{S⁻} of all annotated andunannotated secondary events. The set {S} and {S′} should be equal insize, each representing every secondary event in the current joinwindow. The two subsets of {S′} should be non-overlapping and the set{S+} should contain all possible joins between {P} and {S}. Thus, forevery secondary event s considered part of the join window, if thereexists a valid primary event p for joining within the join window, thenthe pipeline should annotate it s⁺. If no such primary event exists,then the secondary event s⁻ is considered lonely and should beunannotated and placed in subset {S⁻}. As an added measure of success,the events in {S+} should be produced in a greedy fashion, specifically,the downstream consumers should not have to wait for the COB in order toreceive the elements of {S⁺}. Downstream consumers may wait until COBfor the lonely secondary events, as the pipeline is not able todetermine if a secondary event is lonely until all primary events havebeen accounted for.

For example, suppose that a pipeline produces three impressions (A, B,and C) in a 24-hour period. Furthermore, impression A will have uniqueid a, B will have unique id b, and C will have unique id c. Then in thiscase {P}={A, B, C}. Suppose that in addition, the pipeline receives twoclick events, X and Y with unique ids x and y respectively. Click eventX shares join key a and click event Y shares join key d. This thenimplies that {S}={X, Y}. Because click X joins back to A, the pipelineis expected to produce the fully annotated event X⁺ to downstreamcustomers. Thus, the pipeline should produce {S⁺}={X⁺}. Since click Ypoints to a primary event with unique id d, and d is not in the primaryset P, then Y is expected to be lonely, and thus {S⁻}={Y⁻}. Thus,leaving {S′}={X⁺}∪{Y⁻}={X⁺, Y⁻}. If the pipeline were to fail to join Xback to A and produced the set {X⁻, Y⁻}, then this would be considered afailure.

The above conditions for success allow for a few undefined or uncaughtannotations due to late arriving events. For example, if a primary eventp were to show up after the close of books for primary events hasoccurred, there is no explicit requirement that the pipeline mustcorrectly annotate any secondary event s that may be tied to p. Thepipeline may produce either s⁺ or s⁻ in this case (but not both, as thatwould be a duplicate) and will still be considered successful. It shouldbe noted that batch pipelines are also not held to this standard, as thebatch join would not consider any late arriving events at all. So in theprevious example, if event D with join key d were to be delivered to thepipeline after the close of books has occurred on the impression events,the pipeline could potentially produce either {X⁺, Y⁻} or {X⁺, Y⁺}.Either would be acceptable since impression D was late and notconsidered part of the closed set of primary events. The disclosedembodiments handle joins using a distributed database (e.g., Apache®HBase) and thereby meet the above requirements.

FIG. 6A is a flow diagram illustrating a method for processing joins ina streaming processor according to some embodiments of the disclosure.

In step 602 a, the method (600 a) initializes a join table. In someembodiments, the join table comprises a table for a given join type. Inone embodiment, the table is initialized in a distributed database. Inthe illustrated embodiment, the join table includes a key definitioncomprising a join key and one or more columns in the table, each columnassociated with an event that includes the join key. While described asa join table, the table may also be used for sessionization and in theseembodiments is referred to as a session table. As an example, the clickto serve join would include a join key column, a click column, and servecolumn.

In step 604 a, the method (600 a) receives an event. As described above,an event may comprise an event emitted by an event emitter, deliveredover a data transport (e.g., data highway), and processed by one or moreprocessing nodes of a stream processor prior to being received by themethod (600 a). The illustrated method (600 a) may be performed by oneor more nodes of the same stream processor and may output its results toother nodes of the stream processor. As will be discussed, an event maybe a primary or secondary event.

In step 606 a, the method (600 a) classifies the event based on an eventtype and in step 608 a, the method (600 a) branches based on thisclassification. In some embodiments, the event type is stored in theheader of the event. The classification may be made based on the columnsof the join table or may be specified in the programming of the streamprocessing node. Continuing the previous example, the method (600 a) mayextract the event type header and classify “click” events as secondaryand “serve” events as primary events. As illustrated, if the event typeis not associated with a join, the event may bypass processing and beemitted by the method (600 a) without further processing. In otherembodiments, however, an upstream (i.e., preceding) processing node mayfilter events not requiring a join and thus the method (600 a) may neverreceive an event that should not be joined.

If the method (600 a) determines that a secondary event was received,the method (600 a) processes the secondary event in steps 610 a through622 a. Alternatively, if the method (600 a) determines that a primaryevent was received, the method (600 a) processes the primary event insteps 624 a through 634 a.

In step 610 a, the method (600 a) queries the distributed data todetermine if the event exists in the join table. In the illustratedembodiment, the method (600 a) extracts the join key in the event andlooks up the row matching the join key and determines if the columnassociated with the secondary event is null.

In step 612 a, the method (600 a) writes the event to the join table ifthe event is not in the join table. Specifically, the method (600 a)inserts some or all the event data into the join table for the join key.In one embodiment, the only reason the secondary event would not be inthe join table is if this is a replay or similarly duplicated event, inwhich case, there is no reason to write a second time to the distributeddatabase.

In step 614 a, the method (600 a) looks up the primary event in the jointable. In some embodiments, this lookup may be performed as part of step610 a, when the distributed database is queried.

In step 616 a, the method (600 a) determines if the primary event columnfor the join key of the secondary event is null. In the illustratedembodiment, this check is identical to the step in 610 a, albeit for theprimary column.

In step 618 a, the method (600 a) emits a joined event if the primaryevent is present. In this case, the secondary event was received afterthe primary event and thus an in-order join can be performed. In theillustrated embodiment, the method (600 a) executes the join logic onthe secondary and primary events to annotate the secondary event withone or more fields from the primary event.

Alternatively, in step 620 a, the method (600 a) emits a lonelysecondary event if the primary event is not present. In this scenario,the secondary event was received prior to primary event and thus thesecondary event is either out-of-order (if the primary event appears) orpermanently lonely (if the primary event never appears). Thus, when asecondary event arrives and is not immediately joinable, the method (600a) emits the event un-joined. The primary reason for emitting anun-joined event is that such an operation ensures data completeness andallows for replay semantics and COB in a streaming pipeline.Additionally, join operations are not guaranteed. Not every click willsuccessfully join back to a serve in the real world. Thus, un-joinedclicks themselves can be useful for counting by downstream consumers

As illustrated, in step 622 a, the method (600 a) labels the secondaryevent based on the branch in 616 a and before emitting the event in step618 a or 620 a. In the illustrated embodiment, labeling the secondaryevent comprises setting a join status header field of the secondaryevent. The join status field will allow downstream customers (especiallystreaming consumers) to correctly account for the multiple secondaryevents they might receive. In one embodiment, the join status field canbe set to the following values:

-   -   1. FAILED: Indicates that the primary event was not available at        the time when the secondary event arrived (prior to step 620 a).    -   2. SUCCESS IN ORDER: Indicates that the primary event was        received prior to the secondary, and that a successful in order        annotation was performed (prior to step 618 a).    -   3. SUCCESS OUT-OF-ORDER: Indicates that the primary event was        received after the secondary, and that a successful annotation        was performed, but that a downstream consumer may have received        a prior failed join attempt (prior to step 632 a, discussed        infra).

If the method (600 a) classifies the event as a primary event in step608 a, the method (600 a) proceeds to process the primary event in steps626 a through 634 a.

In step 624 a, the method (600 a) queries the distributed data todetermine if the primary event exists in the join table. In theillustrated embodiment, the method (600 a) extracts the join key in theevent and looks up the row matching the join key and determines if thecolumn associated with the primary event is null.

In step 626 a, the method (600 a) writes the event to the join table ifthe event is not in the join table. Specifically, the method (600 a)inserts some or all the event data into the join table for the join key.

In step 628 a, the method (600 a) looks up the secondary event in thejoin table. In some embodiments, this lookup may be performed as part ofstep 624 a, when the distributed database is queried.

In step 630 a, the method (600 a) determines if the secondary eventcolumn for the join key of the primary event is null. In the illustratedembodiment, this check is identical to the step in 624 a, albeit for thesecondary column.

As illustrated, in step 622 a, the method (600 a) labels the secondaryevent based on the branch in 630 a and before emitting the events insteps 632 a and 634 a. In the illustrated embodiment, labeling thesecondary event comprises setting a join status header field of thesecondary event. In the illustrated embodiment, the labeling prior tostep 632 a comprises labeling the secondary event as “SUCCESSOUT-OF-ORDER” as described previously since the primary event wasreceived after the secondary event.

In step 632 a, the method (600 a) emits a joined secondary event if thesecondary event is present. In this case, the secondary event wasreceived before the primary event and thus an out-of-order join can beperformed. In the illustrated embodiment, the method (600 a) executesthe join logic on the secondary and primary events to annotate thesecondary event with one or more fields from the primary event.

In step 634 a, the method (600 a) emits the primary event. Notably, themethod (600 a) always emits the primary event in step 634 a, regardlessof the check in step 630 a. If a secondary event is available, themethod (600 a) will thus emit two events for the single received primaryevent.

As illustrated, the method (600 a) satisfies the greedy requirement inthat annotation occurs as soon as it is possible. In most lambdapipelines, the streaming component does not attempt the out-of-orderjoin, because it is less common, requires more storage, and the batchpipeline will catch this case with less effort. By being greedy aboutthe join, downstream consumers are provided a fully annotated secondaryevent as soon as both elements have successfully passed through thepipeline.

As discussed, in the out-of-order join scenario, the stream processorwill ultimately violate the principal that received and emitted eventsshould match one-to-one. To remedy this, since S⁻ and S⁺ would logicallycontain the same fact key, the two records will be compared by theauditor (310) and successfully deduplicated. Without intervention,however, an arbitrary record may be picked, which could result in eitherS⁻ or S⁺ being written. The success conditions require that S⁺ be chosenif the primary P is counted toward COB. Thus, the auditor (310) isconfigured to always select an annotated secondary to a lonely secondaryby inspecting the join status flag set in step 622 a.

Further, in some scenarios, it is possible that even though S⁻ and P arewritten to the streaming queue (408 b), that S⁺ is lost somewhere in thesystem. The auditor (310) would not be able to detect this case withoutperforming its own join, and thus, would not declare S⁺ as missing. Thisresults in the system not correctly producing an annotated record whenall parts were available. To remedy this problem, the system modifiesthe close of books process via two conditions. In the first condition,the system ensures that in the out-of-order join scenario, that if P issuccessfully written to the streaming queue (408 a), then any S⁻annotated to P will be prevented from being written to the certifiedfact feed, because S⁺ is required in this case. In the second condition,the system ensures that the method (600 c) applies strict ordering tothe processing of events for the same join key. In other words, if aprimary and secondary event for the same join key enters the method (600c) at the same time, the results must be no different than if the eventsentered in a more defined order with a time lag.

With these restrictions, when close of books is certified on the primaryevents, the auditor (310) will be able to presume that all out-of-orderannotated secondary events s⁺ required for the success condition havebeen written to the streaming queue (408 b). In general, the primarycause of failure against the success conditions at this point is thearrival of an S⁺ record after an S⁻ with the same join key. If even oneS⁺ is dropped between the join stage (method 600 c) and the dedupe store(414), then COB can't be declared. But if the first condition issatisfied, then the existence of S⁺ in the streaming queue (408 b) maybe inferred by the presence of P. And the presence of P is implied bythe COB on the primary events. Therefore, the solution under the firstcondition above is to delay auditing of secondary events until COB isdeclared on the primary events. This ensures that if P is necessary forCOB, that P will be replayed if it is missing for some reason.Technically a late primary event could arrive after COB, but the successcriteria does not demand that it be processed correctly since it islate. Essentially these conditions are necessary to ensure success dueto various things that might go wrong in between the method (600 c)performed by the join stage of the stream processor and the spooler(308).

Any processing after the method (600 c) is performed could cause theout-of-order S⁺ event to be dropped after it was annotated. If the S⁺event is dropped, then only the S⁻ will arrive at the auditor (310).When close of books happens, the S⁻ event will be enough to close outthe batch window, thus the pipeline will write S⁻ out to the fact feed(210). This violates the success conditions as S⁺ is bound to a primaryevent that may contribute to COB. However, if the first condition isimplemented, then the pipeline will ensure that S⁻ is not written to thecertified feed due to the presence of an out-of-order P. It is quitepossible that a P will never arrive, in which case the S⁻ is acceptableto be spooled. But if P is present, then S⁻ must be prevented fromspooling.

The second condition prevents a race for writing and reading from thejoin table. Essentially, if the method (600 c) is parallelized, it couldhappen that two joinable events S and P with the same join key couldtravel through the method (600 c) at the same instant. In this case, thepipeline must ensure that at least one of the events is affected by thepassage of the other. If two threads A and B executing the code inparallel. Thread A is processing the primary event and thread B asecondary event that joins back to the same primary. If the order ofoperations is that thread A fetches from the join table and B fetchesfrom the join table before A gets a chance to write its event, then bothA and B will be unable to emit an annotated event. Essentially, thesystem ensures that if two joinable events enter the method (600 c),that at least one of the events will exit the method (600 c) with areference to the other one. Otherwise, if both events make it to the endof the pipeline without annotation, they will satisfy close of books butfail the criteria for successful joining. Thus, this implies the secondcondition, that the pipeline must ensure a strict order of the fetchesand writes with the join table for events with the same key.

In some embodiments, the method (600 c) will receive repeated secondaryevents for the same join key. For example, it is possible for examplethat two distinct clicks may happen on the same serve. In some systemsthe second click is considered non-countable and thus may beinvalidated, but in others, it is considered countable and thus must bepreserved. Regardless of countability, the secondary event must pass allthe way through the pipeline to satisfy the auditor (310). To allowthis, the join table is configured to store multiple secondary eventrecords against the same join key, and the method (600 c) must read allof them from the join table when looking for the out-of-order condition.

In another embodiment, if multiple secondary events are required to bejoined back to the same primary, only a few modifications to the method(600 c) are necessary. Additional columns for each secondary event arerequired, and the first condition discussed above needs to be modifiedaccordingly as such. Specifically, the system ensure that in theout-of-order join case, that if P is successfully spooled to the factfeed, then any S₁ ⁻, S₂ ⁻, . . . , S_(n) ⁻ sharing the same join key asP will be prevented from spooling to the respective secondary event factfeed. Thus, the method (600 c) itself becomes more complex in theproduction of the out-of-order join case. All secondary columns in thejoin table must be scanned to look for early arriving secondaries. Forany early arrival, the method (600 c) should emit their annotatedversions. The primary optimization is that a single join table is used.For COB checking, all secondary COB checks must be dependent on the sameprimary COB check, but can be independent of one another.

As described above, to support the join procedure described in FIG. 6A,two conditions must be met. In the second condition, the system ensuresthat the method (600 c) applies strict ordering to the processing ofevents for the same join key. In other words, if a primary and secondaryevent for the same join key enter the method (600 c) at the same time,the results must be no different than if the events entered in a moredefined order with a time lag. To implement this condition, the systemutilizes a join table with transactional guarantees around get and putcommands, or synchronization in the stage itself is required. In oneembodiment, field grouping by the stream processing may be used if thedistributed database does not provide such guarantees. By specifying thejoin key as the field grouping key, the stream processor will ensurethat all events with the same join key are routed to the same processingnode (e.g., bolt) and thus the same thread of processing. Once eventsare traveling into the same processing step, sequencing can be performedwithin the thread itself.

In the first condition, the system ensures that in the out-of-order joinscenario, that if P is successfully written to the streaming queue (408a), then any S⁻ annotated to P will be prevented from being written tothe certified fact feed, because S⁺ is required in this case.Essentially for each successful out-of-order join annotation, thepipeline must ensure that any failure to process the annotated secondaryrecord will also result in the failure of the processing of thetriggering primary event. Many existing pipeline designs will createparallel paths to process events of different types. Such designs maymake it impractical to enforce the second condition (discussedpreviously) within the pipeline itself as the design requires bringingthe primary and secondary events back together again in the same stage.

In an alternative embodiment of FIG. 6A, the method (600 a) annotateseach primary event with a list of the secondary events that were joinedto it out-of-order. For example, if a primary event P enters the method(600 a) and a secondary event S is found in the join table with id s,then the key s should be annotated to P as a forward reference. Thus, inthe out-of-order case, the method (600 a) will emit the events P{s} andS⁺ to downstream components where P{s} represents event P with the addedreference key s. Essentially, the primary event is modified to containthe forward reference of any out-of-order secondary event it finds inthe join table. The list of forward references may contain multipleevents if there are multiple events being joined to the primary, i.e.,one per secondary event. For example, presume the method (600 a)receives impression event X with id x and the join table alreadycontains click event Y with unique id y and join key x. In this case,the method (600 a) will detect an out-of-order join event and will emitthe impression X and the click Y downstream (note that click Y shouldhave already been emitted earlier, but unannotated due to the absence ofX). Click Y will now be fully annotated with all fields of X, and itwill have a join status indicating out-of-order. Impression X will beannotated with the forward reference y of Click Y. Thus, the impressionevent identifies which click events it caused to be emittedout-of-order.

Finally, in some embodiments, the method (600 a) may be augmented tosupport reentry of events during a replay. Suppose that a primary eventis replayed due to COB processing. When the primary event reaches themethod (600 a), it may find a secondary event waiting for it along witha copy of itself. In some embodiments, if the replayed primary eventknew whether each secondary event in the join table was successfullyannotated and written to the streaming queue, it would be unnecessary toemit the secondary event. However, the only way to obtain this knowledgewould be to lookup the secondary event somehow, or replay it with theknowledge that the secondaries were done in order.

FIG. 5A is a block diagram illustrating a streaming pipeline withsupport for join operations according to some embodiments of thedisclosure.

As illustrated, the pipeline (500 a) includes a stream processor (304),streaming queues (306), spooler (308), and auditor (310). Thesecomponents were described generally in the previous Figures and thosedetails are not repeated herein. In contrast to the previous Figures,FIG. 5A illustrates parallel paths for primary and secondary events. Inthe illustrated embodiment, any of the components may be implemented ina distributed processing system and thus more of fewer such paths mayexist.

In the illustrated embodiment, events are received by the streamprocessor (304) from the data highway (204). The stream processor (304)processes these events in zero or more pre-join stages (502 a) mayperform various operations as described previous (e.g., parsing,explosion, annotation, etc.). The pre-join stages (502 a) then emit thepartially processed events to a join stage (504 a). The join stage (504a) performs some or all the methods described above in connection withFIG. 6A. In brief, the join stage (504 a) performs the annotation. Inputto the join stage (504 a) will be primary and secondary events requiringsessionization. The output will be annotated or lonely secondary eventsas well as primary events.

In some embodiments, each event emitted from the join stage will requirethe following additional attributes. For primary events, an out-of-orderemission set may be added to the event. In one embodiment, theout-of-order emission set comprises a set of secondary event identifiersand event types for any annotated secondary event that was created inthe out-of-order case. The out-of-order emission set corresponds to theforward references discussed above. Both the event type and theidentifier are added to correctly identify the duplicate entries to beflagged. For secondary events, a join status field is set for eachevent. The join status comprises a value such as that described in thecontext of step 622 a.

As illustrated, the join stage (504 a) is communicatively coupled to ajoin table (508 a). In some embodiments, the join table (508 a)comprises an HBase database or other type of database that providespersistence and snapshotting capabilities. In some embodiments,snapshots are created to support reprocessing of events, so that thejoin table (508 a) state can be reconstituted in the event that pastdata needs to be reprocessed. The structure of the join table (508 a)has been discussed previously and that discussion is not repeatedherein.

The output of the join stage (504 a) passes through post-join stages(506 a). Like, pre-join stages (502 a), the post-join stages (506 a) mayperform zero or more processing steps on the joined data and thesestages are not limited in the disclosure. In the illustrated embodiment,the post-join stages (506 a) are configured to multiplex the events tothe primary and secondary dedupe bolts (510 a, 512 a) based on theheaders of the event (e.g., the presence of a join status or thepresence of a list of secondary identifiers, or the lack of either). Inthe illustrated embodiment, the dedupe bolts (510 a, 512 a) implementthe first condition described previously. In brief, the primary dedupebolt (510 a) iterates over the emission set and posts a primary signalevent to the secondary streaming queue (516 a) for each secondary eventit identifies.

In some embodiments, both the join stage (504 a) and the dedupe bolts(510 a, 512 a) utilize a watermark cache to ensure that each event doesnot incur the penalty of a full read/write.

A spooler (308) includes a primary spooler (518 a) and secondary spooler(520 a) to spool primary and secondary events for writing to disk,respectively. The spoolers (518 a, 520 a) operate as previouslydescribed, with the exception that the secondary spooler (520 a)partitions events by join status as well as the primary out-of-ordersignal. By writing into separate files, it is easier for the auditor(310) to efficiently discard events not intended to go into thecertified feed.

As discussed, the auditors (522 a, 524 a) retrieve data from thespoolers (518 a, 520 a) and certify the spooler data for writing to acertified fact feed. In the illustrated embodiment, the primary auditor(522 a) certifies the primary events before it signals the secondaryauditor (524 a) to attempt to certify the secondary events.Additionally, the secondary auditor (524 a) must respect the primaryout-of-order signal to implement the first condition. Essentially foreach row key and versioned value set it obtains from the secondaryspooler (520 a), the auditor (524 a) first determines if at least oneversion of the secondary event has join status “SUCCESS IN ORDER” or“SUCCESS OUT OF ORDER.” If it does, the auditor (524 a) picks the mostrecent received version of these events and writes this event to thecertified feed. Alternatively, if the primary signal is not present thenthe auditor (524 a) writes nothing to the certified feed (essentiallyskipping any join failures). Finally, if neither of the previousconditions are met, the auditor (524 a) writes out the most recentversion of the secondary event to the certified feed, which will belonely and have join status FAILED.

Pipelines that perform joins between events where the cardinality ofprimary and secondary events are nearly identical with short timedilations may benefit from an imposed delay in the join stage.Essentially, with so many primary and secondary events hitting the datahighway and the pipeline at the same time, the probability of anout-of-order join is much higher. In such a pipeline, secondary eventscould be queued and delayed by a configurable margin. In other words, ifthe join table gets a secondary event for which no primary exists, itcould choose to hold the secondary in memory for a short time window toallow the primary event a chance to appear. The small delay inprocessing may reap large gains in efficiency downstream if it can beshown that less out-of-order secondary join events are posted. Asdiscussed above, in the out-of-order join scenario, if the primary doesshow up, the pipeline will have emitted two events. Some pipelines maynot have the luxury of imposing a delay if the business requiresabsolute near real time processing of the un-joined secondary events.

The above-described system pipeline (500 a) supports most reporting usecases, requiring downstream consumers to filter events based upon thejoin status. However, some downstream consumers may require emission oflonely secondary events. As discussed above, in some embodiments, thepipeline (500 a) is configured to not certify lonely secondary events.However, clicks with annotation joins that succeeded are moreappropriate for doing analysis. In this case, the consumer wants theunion of all annotated events and lonely events. This union isrepresented in the fact feed after certification. However, in theprevious system (500 a) the certified fact feed is only provided afterthe auditor verifies the processed events, thus certified events are notprovided in rea-time. This is due to the fact that a secondary eventcannot be labeled lonely until after the audit. Only when the audit iscomplete can the pipeline identify that the lost primary is nevercoming. The following alternative embodiments provide near real-timeoutput of lonely events.

In a first embodiment, the downstream consumer can ingest the certifiedfeed. This technique eliminates real time ingestion but works asexpected. The downstream consumer could also scrape the certified feedfor lonely events and merge those with the successfully annotated eventsit processed in real time. To support this more efficiently, the spooler(308) is configured to partition the certified feed into files ordirectories that clearly delineate which events are lonely. This allowsfor the efficient loading of lonely events without a full feed scan. Inanother embodiment, the pipeline launches a process to post the lonelyevents after the certified feed is posted. This would build off of thepartitioning concept above. In this embodiment, the auditor (310)triggers a spout to read the lonely events and post them to thestreaming queue with a new join status value of “CERTIFIED LONELY.” Thespooler (308) then omits writing any events with this join status to thefact feed, as they have only been posted for streaming queue consumersand the records already exist in the certified feed.

In general, a stream processor (304) should not annotate events withmutable values. For example, textual names and other values shouldgenerally not be joined or annotated with an event based on a databaselookup as these values are mutable and may change. If an underlyingdimension annotation changes, the previously annotated event (ascertified) will be incorrect. Generally, however, immutable values mayproperly be annotated to events. Two examples of common immutable valuesare object relationships (i.e., relationships between events) and pointin time attributes (e.g., the current value of a fee at an instanttime). Generally, any value that is associated with a point in time canbe considered immutable as the presence of a point of time hardens evena mutable value to an immutable one. For example, the title of a productmay change but at a specific point in time, its value is constant.

There are two types of dimensional annotations: types 1 and 2. A type 1dimensional annotation comprises an overwritten value. For example, aprice value may change from one value to another is a type 1 dimensionalannotation. Type 1 dimensional annotations suffer from the problem thathistorical data is not saved during the overwrite. Type 2 dimensionalannotations handle revision histories and thus store historical states.Type 2 dimensional annotations are implemented by inserting an entirelynew event with the updated (i.e., overwritten) value and a pointer backto the previous event.

A primary technical problem with existing pipelines is missingdimensional annotation keys. Consider a campaign where the user has justadded a brand new creative and a pipeline that is required to lookup thecreative's media type (e.g. text, video, image, etc.) Depending on thespeed of the application and ad server caches, it is quite possible thatthe time lag between the insertion of the new creative record and the adserving selecting it for an impression is only seconds long. When thepipeline receives the log of the event, it may not have received the newcreative's attributes. This would result in the pipeline being unable tocorrectly dimensionally annotate the event. Current pipelines compensatefor this deficiencies by either annotating the event with an “unknown”value or marking the entire event as invalid if dimensional annotationfails. This technique only works if the delay between a dimensionalupdate and the pipeline being aware of it is small and stable and onlyif the consumer is able to absorb the overhead of dropping events. Mostbatch pipelines, however, will schedule their batch jobs with adependency on both the dimensional snapshot and the event batch. Thus,as an example, events in the 12:05 to 12:10 time interval will require a12:10, 12:15, 12:30, or even 13:00 snapshot of the dimensional tables inorder to proceed. Since the batch pipeline may require several minutesto receive a complete batch, such a dependency is generally acceptableand is not a viable option for low latency systems.

In addition to the foregoing, another issue that occurs in existingpipelines is out-of-sync dimensional updates. This is an analog to theproblems with missing keys that primarily affects point in timeattributions. Suppose that same dimensional value whose presence impartsa fee. If the lag between the dimension being updated is small (e.g.,ten seconds) the system may still properly handle the event. But a lagof several hours will most likely cause large problems with either overor undercharging customers. In addition, the out-of-sync issue alsotends to cause problems with reprocessing. Suppose that a pipelinecontains a bug and must reprocess data from three days ago. If the datais processed using the current dimensional state, rather than the statefrom three days ago, it will create inconsistencies. Expounding uponthis exposes another issue with streaming pipelines that differs frombatch. In a batch pipeline it is easy to attribute an entire batchinterval with a consistent dimensional snapshot. Every record will beannotated using the same dimensional state. In a streaming pipeline,this is much more difficult to achieve as events are not necessarilyprocessed in sequential order.

A naïve solution to the foregoing problems would be to provide adimensional cache accessible to the stream processor and implement aseparate processing node or step that accesses the cache to annotateevents in real time. However, most pipelines perform anywhere from fiveto 20 dimensional annotations. Querying a dimensional store many times(e.g., 20) per event will significantly impact the availability of thedimensional store given the speed at which events are received,regardless of implementation. Many dimensional stores (such as MySQL)will fail under the load. Thus, a local in-memory cache is necessary forefficiency. But even current in-memory caches are not sufficient.Specifically, many systems provide dimensional tables that will noteasily fit in the memory of a single machine. In a streaming design,many of these issues become exacerbated. Consider the missing dimensionissue. In a batch pipeline, a simple dependency between the events beingprocessed and the dimensional snapshot that applies to them issufficient. If either dependency is delayed in any way, the batch jobwaits until both data sets are available before executing. In astreaming environment, the dependency solution no longer exists. Thepipeline will effectively have an event awaiting annotation and only afew seconds to deal with it. A streaming pipeline cannot wait longenough.

Another issue with large dimensions is how to update the in-memorycaches. Most pipelines employ dimensional snapshotting. Essentiallyevery N minutes, the pipeline executes a full dump of the dimensionaltable (or projection thereof) into some type of efficient lookup file.When dealing with large dimensions, this may become unwieldy, as itmight take more than N minutes to perform the dump.

FIG. 5B is a block diagram illustrating a streaming pipeline accordingto some embodiments of the disclosure.

In the illustrated embodiment, a pipeline (500 b) includes a dimensionsupport system (516 b) communicatively coupled to a stream processor(304). Various details of the stream processor (304) have been providedpreviously and are not repeated herein.

The dimension support system (516 b) includes a dimension store (512 b).The dimension store (512 b) represents a source of truth for dimensionalstate for the pipeline (500 b). Although it could be the actual masterstore used by the platform, in some embodiments the dimension store (512b) comprise a replica of a master store. In the illustrated embodiment,the dimension store (512 b) provides a bulk query interface and,optionally, a point lookup service. In one embodiment, the dimensionstore (512 b) comprises a MySQL database although various other types ofdimension stores may be used such as Oracle, HBase, and periodic HDFSdumps.

The dimension support system (516 b) additionally includes a scheduledbulk query component (506 b). The processes performed by the scheduledbulk query component (506 b) are described in more detail below.

In a first operation, the scheduled bulk query component (506 b)executes (or otherwise coordinates) a bulk query against the dimensionstore according to the stores abilities and limits. In the illustratedembodiment, the scheduled bulk query component (506 b) may be configuredto run at various intervals and dependencies based on the needs of thesystem (516 b). For example, a MySQL based job may run at regularintervals and be set so that only one instance may be running at a timeto prevent overlaps. Another implementation may set a data dependency ona path that is populated with a regular dimensional dump. In eithercase, the purpose of the bulk query is to obtain the relevantdimensional data for the pipeline (500 b) and publish it for thepipeline (500 b) to utilize.

In a second operation, the scheduled bulk query component (506 b)assembles a dimensional lookup file set containing the dimension valuesand uploads the lookup file set to the file system. In some embodiments,this operation requires a definition of a lookup file set. In someembodiments, this definition specifies that the file set should supportboth a single full snapshot, or a snapshot with one or more deltaupdates. Additionally, the definition specifies that the format of thefile set should be optimized for consumption by the pipeline (500 b).This means that as soon as the file is downloaded by the pipeline (500b), it should be immediately usable as a lookup source. The annotationstage (502 b) is not required to parse the file line by line to index ormap it before being able to use it. The second operation completes whenall the necessary components of the file set have been updated to thefile system.

In a third operation, the scheduled bulk query component (506 b) thenpublishes the dimensional lookup file set to the dimension directory(510 b). In this operation, the scheduled bulk query component (506 b)publishes the file set to the dimension directory (510 b) which isdescribed in more detail below. The dimension directory (510 b) providesa lookup table whereby the pipeline (500 b) can determine dimensionalstate by batch interval and publish time. The dimension directory (510b) basically only stores the file paths on the filesystem, rather thanthe dimensions themselves, reducing the size of the table. Once thisstep is complete, the job executed by the scheduled bulk query component(506 b) is considered a success.

In some optional embodiments, the scheduled bulk query component (506 b)performs a fourth operation which includes posting a signal event to thebulk query spout (504 b) indicating the newly published file set. Insome embodiments, if this operation fails, the job is not required torestart. This operation transmits a notification to the pipeline withthe new file set definition. This operation allows the pipeline (500 b)to respond instantly without needing to poll the directory.

In some embodiments, the publish time must fall within the batchinterval. If a bulk query implementation for a five-minute batchinterval takes seven minutes, then the scheduled bulk query component(506 b) cannot publish to the batch interval that was open when thequery started.

As discussed above, the dimension support system (516 b) includes adimension directory (510 b). In some embodiments, this directory (510 b)comprises a single column distributed database (e.g., HBase) table. Inalternative embodiments, if the contents of the table are small enough,a relational database management system (RDBMS) or similar system couldbe used. In the illustrated embodiment, the column stores the file setdefinition and the key to the table should be composed of a dimensionname, batch interval, and publish time. In some embodiments, thesefields are ordered. In one embodiment, the dimension name refers to thetable name (e.g., “line” or “account”) but may include any unique nameby which this lookup is known. The batch interval refers to the batchinterval that this file set is valid for. In general, this will be thebatch interval containing the publish time, but it could vary in thecase that a dimensional set must be replaced for reprocessing. Thepublish time refers to the timestamp at which the dimensions were madeavailable to the pipeline (500 b). In a MySQL-based implementation, thiswould be the timestamp at which the query was finished. For anHDFS-based system, it could be the timestamp of the HDFS directory fromwhich the dimensions were extracted.

In some embodiments, the file set definition comprises a JSON structureor similar serialized data structure. A file set should essentiallyprovide the ability to characterize a dimensional dump in terms of bothfull dumps and deltas. In addition to the file references themselves,the name, publish time, and batch interval may also be included.

The dimension support system (516 b) includes one or more dimensionalsnapshots (508 b). In the illustrated embodiment, the dimensionalsnapshots (508 b) comprise a set of files stored in the file systemcontaining the prepared dimensional file sets.

In the illustrated embodiment, the stream processor (304) includes abulk query signal spout (504 b). In the illustrated embodiment, the bulkquery signal spout (504 b) a spout that allows a set of file definitionsto be posted to the pipeline as they become available and is callablefrom the scheduled bulk query component (506 b). The bulk query signalspout (504 b) provides a notification queue that enables the pipeline toreact to new dimension file sets as soon as they become available. Insome embodiments, the bulk query signal spout (504 b) is directlyconnected to every annotation stage (502 b) in the stream processor(304) via a broadcast stream. Thus, when one dimension file set updateis received, all annotation stages (502 b) should be informed.

In the illustrated embodiment, the dimension support system (516 b)includes an optional dimension lookup service (514 b). The dimensionlookup service (514 b) allows the pipeline (500 b) to handle instanceswhen batch updates are late or incomplete with respect to missingdimensions. Consider the case where a new creative is uploaded andlaunched just after a periodic batch update. It may be possible in thisscenario that an impression event against this new creative is receivedprior to the next batch update. In this case, the annotation stage (502b) will be unable to properly annotate the record. If a dimension lookupservice (514 b) is available, the annotation stage (502 b) may be ableto query the dimensional store indirectly through the service andannotate before proceeding to post-join stages (506 a).

One of the primary concerns of the dimension lookup service (514 b) isto protect the dimensional store. In a MySQL implementation, thedimension lookup service (514 b) may be connected to a replication slavethat is trying to catch up on replication. Because replication isbehind, the pipeline (500 b) may be experiencing a large number ofrecords with missing dimensions, which may cause the annotation stage(502 b) to try the dimension lookup service (514 b) repeatedly. Thisflooding of the replication slave with thousands of queries looking forthe missing dimension will most likely delay replication even further.Therefore, the dimension lookup service (514 b) should maintain aconfigurable throttle on the maximum number of queries that it mayperform against the dimension store over time.

In some embodiments, the dimension lookup service (514 b) comprises aRESTful web service that supports an endpoint for executing apreconfigured named query for a single dimensional key and returns aserialized data object (e.g., JSON object). In some embodiments, theservice (514 b) implements a least-recently used (LRU) cache. The LRUcache stores the results of dimensional query requests made to thestore, to prevent repeat requests. An example of an LRU cache entry isprovided below:

{ rowExists: true, cacheExpiration: “2016-07-10T12:35:10.123Z”, rowLock:<object>, rowData: { id: 12345, media_type: “Video”, pricing_type:“CPM”, price: 10 } }

The cache design caches both successful queries where the row is foundand unsuccessful. In some embodiments, the LRU cache is designed tocache an unsuccessful query to prevent bad actors from masking validrequests. Consider a situation where an ad server starts populating adimensional identifier with a corrupted value as part of a bug. Thiscould cause the annotation stages (502 b) to continuously request avalue that will never exist at a very high rate. In a given rate-limitedtime interval, 99% of the requests could be for this bug's value, while1% are valid. By caching the bad request, the dimension lookup service(514 b) can return that result to the caller without impacting the ratelimiting, allowing other valid requests make their queries. In this way,no request can dominate the limited bandwidth, as all request resultsare cached. In one embodiment, the expiration date on rows in the cacheare calculated based on two different timeout intervals, one for foundand one for not found so that misses can expire before found. Forexample, say a 5-minute expiration when a row is found, but a 5-secondexpiration when a row is not found, to force the query to try again moreoften for missing rows. In addition, the cache maintains a rowLockobject which comprises a mutex that prevents multiple parallel requestsfrom initiating a query against the same dimensional value.

In the illustrated embodiment, the cache allows for annotation at therate required by the pipeline. To achieve this goal, each annotationstage (502 b) needs to be configured so that it can handle a highpercentage of lookups via local memory cache hits. This means that eachannotation stage (502 b) holds an entire dimension set in memory,possibly several versions for various open batch intervals. In oneembodiment, the annotation stage (502 b) utilizes a constant database(CBD) file fronted by an LRU cache. The LRU cache reduces paging forlarge CDB files that do not fit in memory on skewed dimensions. In someembodiments, 80% of the events are covered by 20% of the dimensionalspace. An LRU cache exploits the frequency of these events allowingdirect memory access. The CDB backend provides a disk page cachedversion that allows most lookups to hit active memory, but notnecessarily all of them. Tuning the LRU and memory used by theannotation stage (502 b) allows this design to be flexible.

In some embodiments, file definitions allow for delta processing, whichmeans that several CDB files may be in flight for a single logic fileset definition. Thus, for a single published definition, the annotationstage (502 b) will check the LRU cache, check the delta CDB's in reverseorder, and then perform a full dump until a record is found. If a recordis found, update the LRU cache and proceed with processing. Thus, insome embodiments, the LRU cache is designed to cache a group of CDBfiles.

As described, delta processing in this manner does not allow for“deleted” dimensions. In nearly all systems, dimensions are never truly“deleted”, rather they are soft-deleted by marking the record in someway. The only generally permitted deletes in a database are associationtable deletes, which are generally modelled as set attributes ratherthan as association objects. Because the delta design utilizes chaining,it may not be possible to know that a dimension was deleted versus itwas unchanged in an interval. If this knowledge is necessary, the bulkquery system will need some method of creating a “deleted object”dimensional value.

In the illustrated embodiment, cache maintenance occurs whenever theannotation stage (502 b) detects that a new dimensional file set isavailable. This can occur via the signal spout (504 b), or by periodicinspection of the dimension directory (510 b). In some embodiments, bothtechniques may be used to ensure high availability. As discussed above,the cache itself is a mapping between batch intervals and cache objects.The mapping is not necessarily one to one, as two or more batchintervals may share the same cache object. In one embodiment, the cachemapping process is designed to conserve as much memory as possible,using the file URI (Uniform Resource Identifier) values as a unique key,which allows two distinct file definitions to share the same files.

For each batch interval, zero or more dimension file sets may bepublished. In the case of zero, the batch interval will inherit the mostrecently published dimension file set prior to that interval. So forexample, if batch interval X does not have a published dimension fileset, it will officially use the most recently published dimension fileset from X−1, X−2, etc. until one is found. This is accomplished byscanning in the dimension directory (510 b) in reverse order by keywhich includes the batch interval as the prefix key. For example, in asystem that have 5-minute batch intervals but hourly dimension updates,the file set published at 1500 would be used for all 12 batch intervals1500 to 1555. The reverse is also possible, a pipeline on 5-minute batchintervals could get 1-minute updates. Thus, the 1525 batch intervalmight reference 5 distinct file sets at 1525, 1526, 1527, 1528, and1529. Thus, the many to many relationship. In some embodiments, eachdimension file set is cached as a distinct object. So, in our hourlyexample, the 1500 file set would have a single object caching allrequests against that file set and the reverse example would have 5objects caching 1525 to 1529 respectively.

In one embodiment, each dimension file set has exactly one fulldimension snapshot and zero or more deltas, but that snapshots and deltafiles could be shared among multiple sets. For example, suppose our1-minute example worked as follows. At the top of every 5 minutes, weget a full dimensional dump, but for every minute after, a delta isproduced. In this example the file sets appear as:

-   -   1525→{full: “base1”, delta: [ ]}    -   1526→{full: “base1”, delta: [“delta1”]}    -   1527→{full: “base1”, delta: [“delta1”,“delta2”]}    -   1528→{full: “base1”, delta: [“delta1”,“delta2”,“delta3”]}    -   1529→{full: “base1”, delta:        [“delta1”,“delta2”,“delta3”,“delta4”]}    -   1530→{full: “base2”, delta: [ ]}    -   . . .

The above format is efficiently uses memory, as five differentdimensional states are represented by a single large file and four muchsmaller files, rather than keeping five full snapshots in memoryinstead. Processing-wise, it is slightly less efficient as multiple hashlookups against different memory pages must be performed, but LRU cachesshould provide relief at the expense of one more in the worst case. Inaddition, multiple deltas could be collapsed into singles, though formany dimensions, the deltas may very well be empty, in which case thedelta should be omitted entirely.

In some embodiments, the annotation stage (502 b) maintains a mappingbetween each batch interval and the cache objects that are in use withthat interval. In this embodiment, every batch interval is assigned acache object before events for that batch interval can be processed,even if there is no published file set for that interval. This is doneby looking backward in time to find the most recently prior publishedset. For each mapping, there is a primary cache that will be used on allsubsequent events. For example, when file set 1528 is published duringbatch interval 1525, it shall supersede file set 1527.

Given this structure, when a newly published file set is detected by theannotation stage (502 b), it affects the batch interval to which it ispublished, as well as every other active batch interval afterwards thatwas depending on the cache object this currently replaces. In oneembodiment, there should not be more than on active batch after the oneit is published against, since the publish time must occur in a batchinterval, and the signal should come shortly after that either due tothe signal spout (504 b) or polling.

Before the file set can be mapped, each file in the set must be resolvedby downloading it from the filesystem. In some embodiments, thisdownloading is done in a background thread, rather than blocking thepipeline. Alternatively, if the annotation stage (502 b) has no validmapping for the current interval, which occurs during initialization orperiodically when replaying an event from a prior interval that is nolonger cached, the downloading may be performed via a foreground task.That is, in some embodiments, if any event arrives in the annotationstage (502 b) from a batch interval for which a viable cache object isnot available, the annotation stage (502 b) should pause and load themost recently published cache for that interval or prior. For example,suppose the annotation stage (502 b) initializes during interval X. Theannotation stage (502 b) initializes by loading the latest dimensionspublished for interval X. When an event for interval X+1 arrives, theannotation stage (502 b) need not pause, because the dimensions forinterval X are valid for X+1. But if an event for interval X−1 arrives,the annotation stage (502 b) will need to wait until interval X−1'sdimensions can be loaded. In some embodiments, a limited pause (e.g.,using a timeout) can occur, at which point, if the cache is not ready,it can drop that event and move on. A later replay will enable completeprocessing of the event. In some embodiments, because files are sharedbetween cache objects, only new files need to be loaded from the filesystem since the files are considered immutable when published and onlyone copy is needed in memory at a time.

In some embodiments, the annotation stage (502 b) performs an additionalmaintenance operation the very first time that an event for a batchinterval arrives. The first event for each batch interval will cause anew batch interval and mapping to be tracked. The new batch intervalinherits the mapping from the prior interval.

Additionally, in some embodiments, the annotation stage (502 b) willalso need to expire items from memory from time to time. It multiplefile sets are published during a batch interval, then it is always safeto expire all but the most recent. In the example of five one-minuteupdates per batch interval, file set 1526 may be expired as soon as 1527is available. Also, any batch interval that is closed may be safelyexpired as well. Thus, the annotation stage (502 b) should poll ascoreboard looking for opportunities. Otherwise, an “unsafe” expirationmay be necessary. In this case, the oldest batch interval cache objectsshould be expired in anticipation of closing, but a warning should beissued so that a site engineer knows that caches were expired early anda reconfiguration may be necessary to ensure that sufficient batchintervals may be kept in memory at all times.

In some embodiments, the dimension lookup service (514 b) performs thefollowing method in response to a request. First, the service (514 b)should check the LRU cache to see if the requested value was attemptedrecently. If the LRU contains an entry for the requested value and theexpiration has not passed, then the entry immediately to the callereither as an HTTP 200 OK or an HTTP 404 Not Found depending on the rowstatus. If no entry exists, the entry should be created with a pendingquery status so that other threads can lock appropriately. If no resultis available, the thread should obtain a lock on the row lock object.Upon obtaining the lock, the cached value should be checked again to seeif a result may be returned, otherwise, the lock is held as the threadcontinues. Next, the service (514 b) should check if making anotherquery would violate the maximum query rate against the service. This canbe a local check rather than a shared check from other instances in saya zookeeper ring or similar. The number of independent query lookupservice hosts should be considered when setting the rate limiting. Ifthe local check would violate the current rate limiting, then theservice should return an HTTP 503 Service Unavailable indicating thatrate limit is exceeded and the lock should be released. If the ratelimit is not exceeded, then the service (514 b) should obtain aconnection to the dimension store (optionally using connection pooling),construct and execute a query for the requested value. In the case thatthe query comes up with a value, that value should be serialized into aJSON response, placed in the LRU cache, and then returned to the caller.If the value is not found, then the service (514 b) should return anHTTP 404 Not Found to the caller. The evidence of the call should berecorded against the internal stats for the next round and the lockshould be released, allowing any pending threads to inspect the newstatus of the cached row.

In the illustrated embodiment, the annotation stage (502 b) performsannotation of events based on the dimensions. As indicated above, thepipeline (500 b) may have one or more annotation stages, although onlyone is illustrated in FIG. 5B. An annotation stage (502 b) handles oneor more named dimensional queries. In some embodiments, a singleannotation stage (502 b) performs a single annotation. For each query,the annotation stage (502 b) attempts to annotate the required outputfields with the corresponding lookup annotations. In addition, theannotation stage (502 b) reacts to the newly published dimensional filesets and maintains internal caches. In some embodiments, the operationsof the annotation stage (502 b) are customizable, in which case, theannotation stage (502 b) functions as an annotation framework.

The annotation stage (502 b) receives two input signals, a publishingsignal and an event to annotate. The publishing signal comprises asignal to update internals and is described further herein. In theillustrated embodiment, when the event to annotate is received by theannotation stage (502 b), the annotation stage (502 b) performs one offour actions.

FIG. 6B is a flow diagram illustrating the annotation of an event in astream processor according to some embodiments of the disclosure.

In step 602 b, the method (600 b) receives an event. In someembodiments, the event was processed by one or more stream processingsteps prior to being received.

In step 604 b, the method (600 b) determines if event requiresannotation. If the event does not require annotation, the method (600 b)skips annotation and immediately emits the event to the next processingstage. In this scenario, the event does not require annotation by theannotation stage (502 b) and thus the event will be passed throughunchanged. For example, if the annotation is on a line item id, and theevent does not carry a line item id (e.g., null). It could also happenthat the event's type is not qualified. For example, there may be noreason to annotate a click event with an annotation that is only forimpression events. In some embodiments, an abstract function may becalled by the framework to determine if an annotation should even beattempted.

In step 606 b, the method (600 b) performs an annotation. In theillustrated embodiment, the method (600 c) utilizes the dimensionsupport system (516 b) to annotate the event. The methods performed inthe previous description of the system (516 b) are not repeated indetail herein but are incorporated herein in their entirety.

In one embodiment, the method (600 b) identifies the most recentlypublished dimensional file set for the event's batch interval. In someembodiments, the method (600 b) chooses a file set definition thatsatisfies the dimensional annotation requirements. This file setdefinition will be used to satisfy annotations against this event andnamed dimension combination.

The method (600 b) then calls the implementation to perform theannotation and passes a callback object that allows for lookups to beperformed. In some scenarios, it is possible for the method (600 b) torequest a list of ids, but the entire list may not be known until alookup has been performed. Consider a recursive dimension with parentidentifiers that must be traced up to the root. In this case, upon doingan initial lookup, a new lookup is needed. A request response would bedifficult to use in this case; thus, a callback may be used instead.

In some embodiments, the method (600 b) uses the callback object toperform lookups against the chosen dimensional file set. For eachidentifier that is looked up, the method (600 b) executes a lookupagainst the chosen file set. This includes checking the LRU cache, deltafiles, and full sets until a value is found.

If an annotation cannot be found in the cache object assigned to theevent's batch interval and the cache object is not the most current, themethod (600 b) can check the most current cache to see if thedimensional row may be found there. This situation may occur for late orreprocessed events. It may also be configurable, to prevent lookups thatare far into the future.

If an annotation still cannot be found and the named dimension supportsa dimension lookup service, the method (600 b) can query the service(e.g., 514 b) to look for the new dimension. In one embodiment, the sametechniques used to protect the dimension source in the lookup servicecan be built into the method (600 b) to prevent overload of thedimension lookup service including rate limiting and remembering theresult of recent attempts.

The results of the lookup are then returned to the method (600 b). Inone embodiment, the return value will either be a record indicatingsuccess that contains all of the dimensional attributes for the givenidentifier, or a response code indicating that the identifier was notfound.

The method (600 b) then uses the dimensional attributes to populate newfields within the event. The method (600 b) then returns a status to theframework indicating either success or failure in performing theannotation.

In step 608 b, the method (600 b) determines if the annotation wassuccessful. In the illustrated embodiment, a successful annotationrefers to the scenario where the method (600 b) can identify a suitablepublished dimensional value for the batch interval and identifier forthe received event, then the method (600 a) may successfully compute therequired dimensional annotations and store them in the event. Theannotated value may be a calculation rather than the lookup. Forexample, revenue might be computed based upon the event type, pricingtype, and price which requires custom logic that the framework does nothave, so this action should be abstracted by the framework as well. Ifthe annotation succeeds, the method (600 a) emits the event withannotations.

Alternatively, in step 610 b, the method (600 b) indicates one or moremissing annotations if the annotation is only partially successful. Inthis scenario, if the method (600 b) cannot identify a suitablepublished dimensional value for the batch interval and identifier forthe event, then the method (600 b) may choose to ignore the missingvalue and annotate the event accordingly. In this case, the pipeline(500 b) indicates that a missing dimensional value is acceptable forthis particular annotation and that the failure has been handled by theimplementation. For example, it may not be a serious failure if atargeting profile is not available at annotation time, as the values areonly used for analytics, and thus this event may be ignored by suchanalysis later.

Alternatively, in step 612 b, the method (600 b) flags the event forreplay if the annotation fails completely. In this step, the method (600b) may fail to annotate the event. In this step, if the method (600 b)cannot identify a suitable published dimensional value for the batchinterval and identifier for this event, then the method (600 b) maychoose to fail the event outright due to a missing annotation. Failingthe event will cause the event to be marked in such a way, that theevent will be considered missing by the initial processing of theauditor (310) and replayed later. The event will still be passed on tolater stages, rather than being dropped at this time, but the eventforces a replay (subject to thresholds).

In the illustrated embodiment, an annotation failure occurs when noannotation may be found for a dimension either by cache or lookupservice if available. In some embodiments, the method (600 b) isselective about which annotations should result in failures and whichshould not, as there is a performance and storage penalty for replaying.In some embodiments, an annotation failure is treated similarly to ajoin failure, in that system will allow a later revision. In joinprocessing, if the primary is not available when a secondary isprocessed, the system can identify that a revision to that event mightshow up later if the primary were to arrive. An annotation failure mayresult in the same processing. Thus, the pipeline may later emit arevised version of the event's related facts that contain properlyannotated events.

The following examples are provided to further explain annotationfailures. Suppose that a pipeline that receives two key files on everyimpression, the line_id and the ad_size_id. Line_id identifies the buyerof the ad position, and thus without it, it is impossible to charge theadvertiser, apply order and account level budgets, or similar. The adsize is used to lookup the width and height of the ad that was served.In this case, a pipeline would be justified to allow line id lookups tofail an annotation, because of how critical the field is to invoicing.On the other hand, a missing ad size id would most likely just causesome errant reporting, that could later be fixed with a simple patch. Inthis case, the pipeline would not be configured to fail records due to amissing ad size. Thus, pipeline implementations must consider whatannotation operations can result in failure. In general, if a missingannotation would make the event non billable or non-reportable, thenfailure is probably justified. However, failure should be intelligent.Consider an impression event for which traffic protection or some otherissue would prevent the record from being valid anyhow. In this case, afailed annotation is unimportant anyway, so there is no reason to failit in the annotation stage (502 b).

To implement step 606 b, the method (600 b) adds an annotation statusfield to each event. In some embodiments, the status field indicateswhether the annotation was a success or failure. Success indicates thatall performed annotations succeeded (or were skippable, i.e., partial).Failure indicates that at least one important annotation failed and thusthe event may need to be replayed in some fashion. A pipelineimplementation on the other hand may want to know which importantannotations failed. In this case, in other embodiments, the pipeline addits own annotation status bit flags or reason code, and record them inthe annotation stage (502 b) themselves.

In the illustrated embodiment, the auditor (310) is configured tocompare the number of failed annotations to an annotation failurethreshold before triggering COB. The auditor (310) provides aconfigurable threshold such that if replay is only necessary because offailed annotations and the number of failures is less than or equal tothe threshold, then the auditor (310) may close out the interval withoutattempting replay. Otherwise, if replay is necessary because of otherissues, or there are significant failed annotations, the auditor (310)replays all of the missing annotations with everything else tore-execute the method (600 b).

After either outcome, the method (600 b) will emit the event to thepost-annotation processing stages (step 614 b).

The above method (600 b) works on a single event with a singledimension. However, in other embodiments, multiple dimensions may benecessary against a single event. In these embodiments, memoryconstraints may force a pipeline to split annotation among severalstages (each executing method 600 c). Stage one may be responsible forone set of dimensions, and stage two may be responsible for a secondset, etc. By having the system force isolation of the dimensions, thepipeline can easily remap dimensions to different stages without achange to the method (600 b), only configuration and initialization. Thefollowing provides an alternative embodiment for supporting multipleannotation stages executing the method (600 c).

First, the pipeline must guarantee the order in which dimensionalattribution occurs. Consider a pipeline that must annotation dimensionswith a parent child relationship like Line and Order. In this case, theframework must allow the pipeline implementation to specify that lineannotations precede order annotations, because the pipeline must use theline's order_id attribute to perform the order lookup later. Second,this implies that the implementation must store the order_id in theevent at line lookup time, so that it is able to retrieve it when theorder is looked up later. In this manner, the physical location of thedimensional annotation logic is independent of the logic itself.

In contrast to existing pipelines, there are distinct advantages toperforming dimensional annotation inside a streaming environment versusbatch. Primarily, annotating in a streaming pipeline allows a pipelineto spread out the memory requirements across annotation stages (502 b)versus batches. In batch pipelines, when too many dimensions areannotated within the same batch job, you run into memory issues, wherethere is not enough memory on a node to hold sufficient dimensions incaches. The only way to fix this in a batch pipeline is to perform twobatch jobs, with different sets of dimensions each. This works, exceptthat it requires double the disk input/output (I/O) between batches. Ina streaming platform, only network I/O between physical annotationstages (502 b) is required. FIG. 5C illustrates this configuration andincludes identically named components as FIG. 5B. Descriptions of thoseidentically named components are not repeated herein.

Thus, in a multi-stage pipeline, each annotation stage is an island thatinteracts with the various dimension management componentsindependently. Each annotation stage only responds or interacts on thenamed dimensional queries that it requires, ignoring dimensions managedby other stages. In this environment, the bulk query signal spout (504b) must be setup to broadcast to all annotation stages (502 b). It couldbe configured such that every annotation dimension is assigned its ownstage. In some embodiments, some dimensions may be relatively staticwith only 50 or so values compared to other dimensions that may bemillions in cardinality. Thus, the configuration of stages should beconfigured based on the memory requirements and dimensional ordering andassign dimensions to annotation stages in the pipeline configuration.

Various other alternatives may be implemented alone or in combinationwith the foregoing annotation stage design.

In some embodiments, it may be advantageous to hold an event locallywithout emitting and trying again in a short amount of time. Forexample, if an event attribution id is not found in the cache, but abackground thread is currently loading a new cache, the annotation stage(502 b) may pause and not emit with a failure to see if the missingvalue appears in the cache. This is similar to holding a click eventthat fails to join for a few hundred milliseconds to see if theimpression appears later. In some embodiments, this option is aconfigurable optimization, as some pipelines may not wish to delay atall if they have tight SLA requirements for a consumer that doesn't careif failures occur, like a budget feedback loop.

In another embodiment, the annotation stage (502 b) provides an out oforder annotation function by spooling events that fail to annotate tomemory or disk. If the annotation shows up in the next cache update orlookup service request, any spooled events keyed to that a particularmissing identifier could be re-annotated and emitted. This would preventwaiting for replays. In this case, the annotation stage (502 b) needs toindex a local store by missing attribute values. When a lookup servicesucceeds for a value that was previously missing, a background threadcan launch to de-spool prior missing events. Likewise, when a new cacheis downloaded, a background thread can check each missing valuecurrently being tracked to see if any of them can now be resolved.

In some embodiments, most dimensions using numeric primary keys aregenerated in a monotonically increasing sequence. In other words, thefirst record is one, the second is two, up to a maximum integer value.This makes it possible to do a quick range check when looking up adimensional value to see if a value is cached. For example, if a recordrequires a lookup of value 123, but the cache is known to contain onlyvalues 1 to 120, then there is no reason to look in the cache. In viewof this, the bulk query job (506 b) may be configured to record theminimum and maximum key value of a dimension and store this in thedimensional file set definition. This embodiment can help avoid checkingindividual files by performing a range check prior to looking in thefile. But the real value of the optimization is in the auditor. If theevent is annotated with the query name and ID for the first failedannotation during processing, then the auditor can perform a range checkagainst the latest dimensional set in the pipeline. No events need to bereplayed due to failed annotations that also fail the range check, asthe replay will not be able to find the missing dimension. Fornon-numeric keys or for numeric keys that are sparsely populated, a timestamp can be used as well. The event can then be annotated with the mostcurrent publish time of the available caches in the annotation stage(502 b). Then the auditor (310) can check the most recently publish timein the dimension directory to see if any new dimensional updates areavailable. If there are no new published caches, then there is no reasonto replay the record.

For large dimensions, it may be advantageous to separate them into theirown annotation stage (502 b) and provide a grouping stream on the keylookup field. For example, consider a large dimension like a search termkey which may be hundreds of megabytes in size. To speed annotation, agrouping stream can direct events with the same search term to the sameannotation stage (502 b). This allows the annotation stages (502 b) toeffectively cache only a portion of the dimensional values. At aminimum, the LRU caches will be more efficient. Rather than a fieldgrouping, the system may hash the dimensional values into bucketsbeforehand as part of the bulk query job. Each annotation stage (502 b)in the annotation group for that dimension would be assigned a portionof the buckets that it will cache. When the dimensional file set ispublished, the stage need only copy the buckets that it will receiveevents for. A custom stream then sends events to the appropriate bucket.This method has the advantage of lessening the number of bytes that needto be downloaded by each annotation stage (502 b). Better failover maybe achieved by having buckets managed by two different annotation stages(502 b) with a stream that round robins between both annotation stages(502 b) assigned to a bucket until one goes down. This allows otherannotation stages (502 b) to shoulder the burden of a failed annotationstage (502 b).

FIG. 7 is a schematic diagram illustrating a computing device showing anexample embodiment of a client or server device used in the variousembodiments of the disclosure.

The computing device (700) may include more or fewer components thanthose shown in FIG. 7 . For example, a server computing device may notinclude audio interfaces, displays, keypads, illuminators, hapticinterfaces, GPS receivers, cameras, or sensors.

As shown in the figure, the device (700) includes a processing unit(CPU) (722) in communication with a mass memory (730) via a bus (724).The computing device (700) also includes one or more network interfaces(750), an audio interface (752), a display (754), a keypad (756), anilluminator (758), an input/output interface (760), a haptic interface(762), an optional global positioning systems (GPS) receiver (764) and acamera(s) or other optical, thermal, or electromagnetic sensors (766).Device (700) can include one camera/sensor (766), or a plurality ofcameras/sensors (766), as understood by those of skill in the art. Thepositioning of the camera(s)/sensor(s) (766) on the device (700) canchange per device (700) model, per device (700) capabilities, and thelike, or some combination thereof.

The computing device (700) may optionally communicate with a basestation (not shown), or directly with another computing device. Networkinterface (750) is sometimes known as a transceiver, transceivingdevice, or network interface card (NIC).

The audio interface (752) produces and receives audio signals such asthe sound of a human voice. For example, the audio interface (752) maybe coupled to a speaker and microphone (not shown) to enabletelecommunication with others or generate an audio acknowledgment forsome action. Display (754) may be a liquid crystal display (LCD), gasplasma, light-emitting diode (LED), or any other type of display usedwith a computing device. Display (754) may also include atouch-sensitive screen arranged to receive input from an object such asa stylus or a digit from a human hand.

Keypad (756) may comprise any input device arranged to receive inputfrom a user. Illuminator (758) may provide a status indication orprovide light.

The computing device (700) also comprises input/output interface (760)for communicating with external devices, using communicationtechnologies, such as USB, infrared, Bluetooth™, or the like. The hapticinterface (762) provides tactile feedback to a user of the clientdevice.

Optional GPS transceiver (764) can determine the physical coordinates ofthe computing device (700) on the surface of the Earth, which typicallyoutputs a location as latitude and longitude values. GPS transceiver(764) can also employ other geo-positioning mechanisms, including, butnot limited to, triangulation, assisted GPS (AGPS), E-OTD, CI, SAI, ETA,BSS, or the like, to further determine the physical location of thecomputing device (700) on the surface of the Earth. In one embodiment,however, the computing device (700) may through other components,provide other information that may be employed to determine a physicallocation of the device, including, for example, a MAC address, InternetProtocol (IP) address, or the like.

Mass memory (730) includes a RAM (732), a ROM (734), and other storagemeans. Mass memory (730) illustrates another example of computer storagemedia for storage of information such as computer-readable instructions,data structures, program modules, or other data. Mass memory (730)stores a basic input/output system (“BIOS”) (740) for controlling thelow-level operation of the computing device (700). The mass memory alsostores an operating system (741) for controlling the operation of thecomputing device (700)

Applications (742) may include computer-executable instructions which,when executed by the computing device (700), perform any of the methods(or portions of the methods) described previously in the description ofthe preceding Figures. In some embodiments, the software or programsimplementing the method embodiments can be read from hard disk drive(not illustrated) and temporarily stored in RAM (732) by CPU (722). CPU(722) may then read the software or data from RAM (732), process them,and store them to RAM (732) again.

For this disclosure, a module is a software, hardware, or firmware (orcombination thereof) system, process or functionality, or componentthereof. A module performs or facilitates the processes, features, orfunctions described herein (with or without human interaction oraugmentation). A module can include sub-modules. Software components ofa module may be stored on a computer-readable medium for execution by aprocessor. Modules may be integral to one or more servers or be loadedand executed by one or more servers.

The terms “user,” “subscriber,” “consumer” or “customer” refer to a userof an application or applications as described herein or a consumer ofdata supplied by a data provider. By way of example, and not limitation,the term “user” or “subscriber” can refer to a person who receives dataprovided by the data or service provider over the Internet in a browsersession, or can refer to an automated software application whichreceives the data and stores or processes the data.

One of skill in the art may implement the methods and systems of thepresent disclosure in many manners. As such, the disclosed embodimentsare not to be limited by the preceding exemplary embodiments andexamples. In other words, functional elements being performed by singleor multiple components, in various combinations of hardware and softwareor firmware, and individual functions, may be distributed among softwareapplications at either the client level or server level or both. In thisregard, one may combine any number of the features of the differentembodiments described herein into single or multiple embodiments, andalternate embodiments having fewer than or more than, all the featuresdescribed herein are possible.

Functionality may also be, in whole or in part, distributed amongmultiple components, in manners now known or to become known. Thus,myriad software/hardware/firmware combinations are possible in achievingthe functions, features, interfaces, and preferences described herein.Moreover, the scope of the present disclosure covers conventionallyknown manners for carrying out the described features and functions andinterfaces. The scope of the present disclosure may also covervariations and modifications made to the hardware or software orfirmware components described herein as would be understood by thoseskilled in the art.

Furthermore, the embodiments of methods presented and described asflowcharts in this disclosure are provided by way of example to providea complete understanding of the technology. The disclosed methods arenot limited to the operations and logical flow presented herein.Alternative embodiments exist that alter the order of the variousoperations or include independent sub-operations that are part of a moreextensive operation.

While the disclosure describes various embodiments, such embodimentsshould not limit the teaching of this disclosure to those embodiments.Various changes and modifications may be made to the elements andoperations described above to obtain a result that remains within thescope of the systems and processes described in this disclosure.

What is claimed is:
 1. A method comprising: receiving, at a streamprocessor, primary event via an input stream; writing, by the streamprocessor, the primary event to a join table upon determining that theprimary event has not been written to the join table; querying, by thestream processor, the join table for a secondary event received via theinput stream; if the secondary event is in the join table: updating, bythe stream processor, a status of the secondary event, generating, bythe stream processor, an augmented event, the augmented event comprisingfields from both the primary event and the secondary event, andemitting, by the stream processor, the augmented event to downstreamconsumer; and emitting, by the stream processor, the primary event. 2.The method of claim 1, further comprising: determining that thesecondary event is not in the join table; receiving the secondary eventafter emitting the primary event; and determining that the join tableincludes the primary event.
 3. The method of claim 2, further comprisinglabeling the secondary event as an in-order join if the join tableincludes the primary event.
 4. The method of claim 1, furthercomprising: labeling the secondary event as an out-of-order join if thejoin table includes the secondary event.
 5. The method of claim 1, thegenerating an augmented event comprising annotating the event with animmutable value, the immutable value stored in a dimension store.
 6. Themethod of claim 5, further comprising labeling the event with anannotation label based on whether the annotating was successful, afailure, or partially successful.
 7. A non-transitory computer-readablestorage medium for tangibly storing computer program instructionscapable of being executed by a computer processor, the computer programinstructions defining steps of: receiving, at a stream processor, aprimary event via an input stream; writing, by the stream processor, theprimary event to a join table upon determining that the primary eventhas not been written to the join table; querying, by the streamprocessor, the join table for a secondary event received via the inputstream; if the secondary event is in the join table: updating, by thestream processor, a status of the secondary event, generating, by thestream processor, an augmented event comprising fields from both theprimary event and the secondary event, and emitting, by the streamprocessor, the augmented event to downstream consumer; and emitting, bythe stream processor, the primary event.
 8. The computer-readablestorage medium of claim 7, the steps further comprising: determiningthat the secondary event is not in the join table; receiving thesecondary event after emitting the primary event; and determining thatthe join table includes the primary event.
 9. The computer-readablestorage medium of claim 8, the steps further comprising labeling thesecondary event as an in-order join if the join table includes theprimary event.
 10. The computer-readable storage medium of claim 8, thesteps further comprising: labeling the secondary event as anout-of-order join if the join table includes the secondary event. 11.The computer-readable storage medium of claim 7, the generating anaugmented event comprising annotating the event with an immutable value,the immutable value stored in a dimension store.
 12. Thecomputer-readable storage medium of claim 11, the steps furthercomprising labeling the event with an annotation label based on whetherthe annotating was successful, a failure, or partially successful. 13.An apparatus comprising: a processor; and a storage medium for tangiblystoring thereon program logic for execution by the processor, the storedprogram logic causing the processor to perform operations of: receivinga primary event via an input stream; writing the primary event to a jointable upon determining that the primary event has not been written tothe join table; querying the join table for a secondary event receivedvia the input stream; if the secondary event is in the join table:updating, by the stream processor, a status of the secondary event,generating an augmented event based on the event, the augmented eventcomprising fields from both the primary event and the secondary event,and emitting the augmented event to downstream consumer; and emitting,by the stream processor, the primary event.
 14. The apparatus of claim13, the operations further comprising: determining that the secondaryevent is not in the join table; receiving the secondary event afteremitting the primary event; determining that the join table includes theprimary event; labeling the secondary event as an in-order join if thejoin table includes the primary event.
 15. The apparatus of claim 13,the operations further comprising: labeling the secondary as anout-of-order join if the join table includes the secondary event. 16.The apparatus of claim 13, the generating an augmented event comprisingannotating the event with an immutable value, the immutable value storedin a dimension store.